Detection rules › YARA-L

YARA-L rules: 1h

Rule	Severity
Cred Dump Tools Dropped Files	`high`
Process Launch VT Enrichment	`high`
Recon Environment Enumeration Active Directory CISA Report	`low`
Suspicious Powershell In Registry Run Keys	`medium`

Cred Dump Tools Dropped Files

Severity: high
Type: Detection
Time window: 5m
Match by: hostname
Author: Teymur Kheirkhabarov, oscd.community
Source: github.com/chronicle/detection-rules

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Known False Positives

Legitimate Administrator using tool for password recovery

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

References

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule cred_dump_tools_dropped_files {

  meta:
    author = "Teymur Kheirkhabarov, oscd.community"
    description = "Files with well-known filenames (parts of credential dump software or files produced by them) creation"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Cred Dump Tools Dropped Files"
    sigma_uuid = "8fbf3271-1ef6-4e94-8210-03c2317947f6"
    sigma_status = "test"
    rule_id = "mr_1ba84a4c-c6cf-49ee-902d-5e9e6efcaac0"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Legitimate Administrator using tool for password recovery"

  events:
    $file.metadata.event_type = "FILE_CREATION"
    (
        re.regex($file.target.file.full_path, `\\(fgdump-log|kirbi|pwdump|pwhashes|wce_ccache|wce_krbtkt)`) nocase or
        re.regex($file.target.file.full_path, `\\(cachedump\.exe|cachedump64\.exe|DumpExt\.dll|DumpSvc\.exe|Dumpy\.exe|fgexec\.exe|lsremora\.dll|lsremora64\.dll|NTDS\.out|procdump64\.exe|pstgdump\.exe|pwdump\.exe|SAM\.out|SECURITY\.out|servpw\.exe|servpw64\.exe|SYSTEM\.out|test\.pwd|wceaux\.dll)$`) nocase
    )
    $file.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($file.principal.user.userid = "user" and $file.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($file.principal.hostname)
    $principal_process_pid = array_distinct($file.principal.process.pid)
    $principal_process_command_line = array_distinct($file.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($file.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($file.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($file.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($file.principal.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($file.principal.user.userid)
    $target_file_sha256 = array_distinct($file.target.file.sha256)
    $target_file_full_path = array_distinct($file.target.file.full_path)

  condition:
    $file
}

YARA-L Rule Structure

Condition

Fires when at least one $file event in the 5m window.

Events

`$file` `FILE_CREATION` (`11`)

target.file.full_path matches "\\(fgdump-log|kirbi|pwdump|pwhashes|wce_ccache|wce_krbtkt)"
target.file.full_path matches "\\(cachedump\.exe|cachedump64\.exe|DumpExt\.dll|DumpSvc\.exe|Dumpy\.exe|fgexec\.exe|lsremora\.dll|lsremora64\.dll|NTDS\.out|procdump64\.exe|pstgdump\.exe|pwdump\.exe|SAM\.out|SECURITY\.out|servpw\.exe|servpw64\.exe|SYSTEM\.out|test\.pwd|wceaux\.dll)$"

Match and Correlation

Match key: $hostname (principal.hostname)
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(if($file.principal.user.userid = "user" and $file.principal.hostname = "hostname", 0, 15))`
`principal_hostname`	`array_distinct($file.principal.hostname)`
`principal_process_pid`	`array_distinct($file.principal.process.pid)`
`principal_process_command_line`	`array_distinct($file.principal.process.command_line)`
`principal_process_file_sha256`	`array_distinct($file.principal.process.file.sha256)`
`principal_process_file_full_path`	`array_distinct($file.principal.process.file.full_path)`
`principal_process_product_specific_process_id`	`array_distinct($file.principal.process.product_specific_process_id)`
`principal_process_parent_process_product_specific_process_id`	`array_distinct($file.principal.process.parent_process.product_specific_process_id)`
`principal_user_userid`	`array_distinct($file.principal.user.userid)`
`target_file_sha256`	`array_distinct($file.target.file.sha256)`
`target_file_full_path`	`array_distinct($file.target.file.full_path)`

Process Launch VT Enrichment

Severity: high
Type: alert
Time window: 5m
Match by: hostname
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Identify process creations that are tagged exploit in VT

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Sysmon	Event ID 11: FileCreate
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule process_launch_vt_enrichment {

  meta:
    author = "Google Cloud Security"
    description = "Identify process creations that are tagged exploit in VT"
    rule_id = "mr_cf022210-8063-4aa0-9ad3-b2a2f7a7f725"
    rule_name = "Process Launch VT Enrichment"
    type = "alert"
    tags = "vt enrichment"
    data_source = "crowdstrike"
    severity = "High"
    priority = "High"

  events:
    ($process.metadata.event_type = "PROCESS_LAUNCH" or $process.metadata.event_type = "FILE_CREATION")
    $process.principal.hostname = $hostname
    // Enriched field from VirusTotal integration, can be commented out or modified if not using
    any $process.target.file.tags = "exploit" nocase

  match:
    $hostname over 5m

  outcome:
    $risk_score = 85
    $event_count = count_distinct($process.metadata.id)
    // added to populate alert graph with additional context
    // Commented out principal.hostname because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $target_file_sha256 = array_distinct($process.target.file.sha256)
    $target_file_full_path = array_distinct($process.target.file.full_path)

  condition:
    $process
}

YARA-L Rule Structure

Condition

Fires when at least one $process event in the 5m window.

Events

`$process` `PROCESS_LAUNCH` (`1`, `11`, `4688`)

target.file.tags = "exploit"

Match and Correlation

Match key: $hostname (principal.hostname)
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`85`
`event_count`	`count_distinct($process.metadata.id)`
`principal_process_pid`	`array_distinct($process.principal.process.pid)`
`principal_process_command_line`	`array_distinct($process.principal.process.command_line)`
`principal_process_file_sha256`	`array_distinct($process.principal.process.file.sha256)`
`principal_process_file_full_path`	`array_distinct($process.principal.process.file.full_path)`
`principal_process_product_specific_process_id`	`array_distinct($process.principal.process.product_specific_process_id)`
`principal_process_parent_process_product_specific_process_id`	`array_distinct($process.principal.process.parent_process.product_specific_process_id)`
`target_process_pid`	`array_distinct($process.target.process.pid)`
`target_process_command_line`	`array_distinct($process.target.process.command_line)`
`target_process_file_sha256`	`array_distinct($process.target.process.file.sha256)`
`target_process_file_full_path`	`array_distinct($process.target.process.file.full_path)`
`target_process_product_specific_process_id`	`array_distinct($process.target.process.product_specific_process_id)`
`principal_user_userid`	`array_distinct($process.principal.user.userid)`
`target_file_sha256`	`array_distinct($process.target.file.sha256)`
`target_file_full_path`	`array_distinct($process.target.file.full_path)`

Recon Environment Enumeration Active Directory CISA Report

Severity: low
Type: hunt
Time window: 15m
Match by: hostname
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects group enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1069.002` Permission Groups Discovery: Domain Groups

References

https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule recon_environment_enumeration_active_directory_cisa_report {

  meta:
    author = "Google Cloud Security"
    description = "Detects group enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into"
    rule_id = "mr_f7609336-c490-4601-bb75-1a1a142ad1cd"
    rule_name = "Recon Environment Enumeration Active Directory CISA Report"
    type = "hunt"
    platform = "Windows"
    data_source = "microsoft sysmon, windows event logs"
    tactic = "TA0007"
    technique = "T1069.002"
    reference = "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
    severity = "Low"
    priority = "Low"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.principal.hostname = $hostname
    $process.target.process.command_line = $command_line

    // cisa report referenced cmd /c in their report throughout, can filter this in/out for tuning as desired
    (
        re.regex($process.target.process.command_line, `(|cmd.*/c).*net.*localgroup.*administrators`) nocase or
        re.regex($process.target.process.command_line, `(|cmd.*/c).*net.*group.*\/dom`) nocase or
        re.regex($process.target.process.command_line, `(|cmd.*/c).*net.*group.*Domain.*Admins.*\/dom`) nocase
    )

  match:
    $hostname over 15m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($process.metadata.id)
    $unique_command_line_threshold = max(1)
    // added to populate alert graph with additional context
    // Commented out principal.hostname because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$principal_hostname = array_distinct($process.principal.hostname)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)

  condition:
    // modify the condition value for command line to throttle how many of these commands can be issued until the rule is triggered
    $process and #command_line > 3
}

YARA-L Rule Structure

Condition

Fires when at least one $process event in the 15m window and $command_line occurs more than 3 times in the 15m window.

Events

`$process` `PROCESS_LAUNCH` (`1`, `4688`)

target.process.command_line matches "(|cmd.*/c).*net.*localgroup.*administrators"
target.process.command_line matches "(|cmd.*/c).*net.*group.*\/dom"
target.process.command_line matches "(|cmd.*/c).*net.*group.*Domain.*Admins.*\/dom"

Match and Correlation

Match key: $hostname (principal.hostname)
Within: 15m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`35`
`event_count`	`count_distinct($process.metadata.id)`
`unique_command_line_threshold`	`max(1)`
`principal_process_pid`	`array_distinct($process.principal.process.pid)`
`principal_process_command_line`	`array_distinct($process.principal.process.command_line)`
`principal_process_file_sha256`	`array_distinct($process.principal.process.file.sha256)`
`principal_process_file_full_path`	`array_distinct($process.principal.process.file.full_path)`
`principal_process_product_specific_process_id`	`array_distinct($process.principal.process.product_specific_process_id)`
`principal_process_parent_process_product_specific_process_id`	`array_distinct($process.principal.process.parent_process.product_specific_process_id)`
`target_process_pid`	`array_distinct($process.target.process.pid)`
`target_process_command_line`	`array_distinct($process.target.process.command_line)`
`target_process_file_sha256`	`array_distinct($process.target.process.file.sha256)`
`target_process_file_full_path`	`array_distinct($process.target.process.file.full_path)`
`target_process_product_specific_process_id`	`array_distinct($process.target.process.product_specific_process_id)`
`principal_user_userid`	`array_distinct($process.principal.user.userid)`

Suspicious Powershell In Registry Run Keys

Severity: medium
Time window: 5m
Match by: hostname
Author: frack113, Florian Roth (Nextron Systems)
Source: github.com/chronicle/detection-rules

Detects potential PowerShell commands or code within registry run keys

Known False Positives

Legitimate admin or third party scripts

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

References

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)
Security-Auditing	Event ID 4657: A registry value was modified.

Rule Body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule suspicious_powershell_in_registry_run_keys {

  meta:
    author = "frack113, Florian Roth (Nextron Systems)"
    description = "Detects potential PowerShell commands or code within registry run keys"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Suspicious Powershell In Registry Run Keys"
    rule_id = "mr_ad75681b-474a-4022-9e35-d6beffcf9a4a"
    sigma_uuid = "8d85cf08-bf97-4260-ba49-986a2a65129c"
    sigma_status = "test"
    tactic = "TA0003"
    technique = "T1547.001"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "Medium"
    priority = "Medium"
    false_positives = "Legitimate admin or third party scripts"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    (
        (
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\software\\microsoft\\windows\\currentversion\\run") or
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\software\\wow6432node\\microsoft\\windows\\currentversion\\run") or
            strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\run")
        )
        and
        (
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "powershell") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "pwsh ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "frombase64string") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ".downloadfile(") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ".downloadstring(") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), " -w hidden ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), " -w 1 ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "-windowstyle hidden") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "-window hidden") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), " -nop ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), " -encodedcommand ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "-executionpolicy bypass") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "invoke-expression") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "iex (") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "invoke-command") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "icm -") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "invoke-webrequest") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "iwr ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), " -noni ") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), " -noninteractive ")
        )
    )

    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}

YARA-L Rule Structure

Condition

Fires when at least one $reg event in the 5m window.

Events

`$reg` `REGISTRY_MODIFICATION` (`13`, `4657`)

target.registry.registry_key contains "\software\microsoft\windows\currentversion\run"
target.registry.registry_key contains "\software\wow6432node\microsoft\windows\currentversion\run"
target.registry.registry_key contains "\software\microsoft\windows\currentversion\policies\explorer\run"
target.registry.registry_value_data contains "powershell"
target.registry.registry_value_data contains "pwsh "
target.registry.registry_value_data contains "frombase64string"
target.registry.registry_value_data contains ".downloadfile("
target.registry.registry_value_data contains ".downloadstring("
target.registry.registry_value_data contains " -w hidden "
target.registry.registry_value_data contains " -w 1 "
target.registry.registry_value_data contains "-windowstyle hidden"
target.registry.registry_value_data contains "-window hidden"
target.registry.registry_value_data contains " -nop "
target.registry.registry_value_data contains " -encodedcommand "
target.registry.registry_value_data contains "-executionpolicy bypass"
target.registry.registry_value_data contains "invoke-expression"
target.registry.registry_value_data contains "iex ("
target.registry.registry_value_data contains "invoke-command"
target.registry.registry_value_data contains "icm -"
target.registry.registry_value_data contains "invoke-webrequest"
target.registry.registry_value_data contains "iwr "
target.registry.registry_value_data contains " -noni "
target.registry.registry_value_data contains " -noninteractive "

Match and Correlation

Match key: $hostname (principal.hostname)
Within: 5m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))`
`principal_hostname`	`array_distinct($reg.principal.hostname)`
`principal_process_pid`	`array_distinct($reg.principal.process.pid)`
`principal_process_file_full_path`	`array_distinct($reg.principal.process.file.full_path)`
`principal_process_product_specific_process_id`	`array_distinct($reg.principal.process.product_specific_process_id)`
`principal_user_userid`	`array_distinct($reg.principal.user.userid)`
`target_registry_key`	`array_distinct($reg.target.registry.registry_key)`
`target_registry_value_data`	`array_distinct($reg.target.registry.registry_value_data)`
`log_type`	`array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))`

Back to all YARA-L rules

YARA-L rules: 1h

Cred Dump Tools Dropped Files

Known False Positives

MITRE ATT&CK Coverage

References

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$file FILE_CREATION (11)

Match and Correlation

Outcome

Process Launch VT Enrichment

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$process PROCESS_LAUNCH (1, 11, 4688)

Match and Correlation

Outcome

Recon Environment Enumeration Active Directory CISA Report

MITRE ATT&CK Coverage

References

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$process PROCESS_LAUNCH (1, 4688)

Match and Correlation

Outcome

Suspicious Powershell In Registry Run Keys

Known False Positives

MITRE ATT&CK Coverage

References

Telemetry Coverage

Rule Body

YARA-L Rule Structure

Condition

Events

$reg REGISTRY_MODIFICATION (13, 4657)

Match and Correlation

Outcome

`$file` `FILE_CREATION` (`11`)

`$process` `PROCESS_LAUNCH` (`1`, `11`, `4688`)

`$process` `PROCESS_LAUNCH` (`1`, `4688`)

`$reg` `REGISTRY_MODIFICATION` (`13`, `4657`)