Sigma rules: 1o

title: Access To Crypto Currency Wallets By Uncommon Applications
id: f41b0311-44f9-44f0-816d-dd45e39d4bc8
status: test
description: |
    Detects file access requests to crypto currency files by uncommon processes.
    Could indicate potential attempt of crypto currency wallet stealing.
references:
    - Internal Research
author: X__Junior (Nextron Systems)
date: 2024-07-29
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        - FileName|contains:
              - '\AppData\Roaming\Ethereum\keystore\'
              - '\AppData\Roaming\EthereumClassic\keystore\'
              - '\AppData\Roaming\monero\wallets\'
        - FileName|endswith:
              - '\AppData\Roaming\Bitcoin\wallet.dat'
              - '\AppData\Roaming\BitcoinABC\wallet.dat'
              - '\AppData\Roaming\BitcoinSV\wallet.dat'
              - '\AppData\Roaming\DashCore\wallet.dat'
              - '\AppData\Roaming\DogeCoin\wallet.dat'
              - '\AppData\Roaming\Litecoin\wallet.dat'
              - '\AppData\Roaming\Ripple\wallet.dat'
              - '\AppData\Roaming\Zcash\wallet.dat'
    filter_main_system:
        Image: System
    filter_main_generic:
        # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_defender:
        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
        Image|endswith:
            - '\MpCopyAccelerator.exe'
            - '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Antivirus, Anti-Spyware, Anti-Malware Software
    - Backup software
    - Legitimate software installed on partitions other than "C:\"
    - Searching software such as "everything.exe"
level: medium

title: Antivirus - APT Malware Signature
id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a
status: experimental
description: |
    Detects a highly relevant Antivirus alert that reports APT malware.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
author: Arnim Rupp (Nextron Systems)
date: 2026-06-15
tags:
    - attack.execution
    - attack.t1203
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: antivirus
detection:
    selection:
        - Signature|re:
              - 'APT\d'
              - 'ATK\d'
              - 'UNC\d'
              - 'UAC\d'
        - Signature|contains:
              - "[APT]"
              - 'APT_'
              - 'APT-'
              - 'BackOrder'
              - 'BlindingCan'
              - 'Blizzard'
              - 'Chollima'
              - 'Cleaver'
              - 'Cobra'
              - 'DarkHotel'
              - 'Dragon'
              - 'DTrack'
              - 'Equation'
              - 'GiftedCrook'
              - 'GraphSteel'
              - 'GreyEnergy'
              - 'GEnergy'
              - 'GrimPlant'
              - 'Hydra'
              - 'Jackal'
              - 'Kitten'
              - 'Kimsuky'
              - 'Lazar'  # Lazarus
              - 'LightRail'
              - 'Lotus'
              - 'Luminous'
              - 'LumiMoth'
              - 'Nimbus'
              - 'Manticore'
              - 'MiniBike'
              - 'MiniBrowse'
              - 'MiniBus'
              - 'MiniFast'
              - 'MiniJuke'
              - 'MiniUpdate'
              - 'MuddyWater'
              - 'NukeSped'
              - 'OilRig'
              - 'Panda'
              - 'Sandstorm'
              - 'SandWorm'
              - 'Seamonkey'
              - 'Sleet'
              - 'SlugResin'
              - 'SnailResin'
              - 'Snake'
              - 'Tempest'
              - 'Tsunami'
              - 'Turla'
              - 'Typhoon'
              - 'UAC_'
              - 'UAC-'
              - 'UNC_'
              - 'UNC-'
              - 'VinoSiren'
              - 'Winnti'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: APT PRIVATELOG Image Load Pattern
id: 33a2d1dd-f3b0-40bd-8baf-7974468927cc
status: test
description: Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances
references:
    - https://web.archive.org/web/20210901184449/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html
author: Florian Roth (Nextron Systems)
date: 2021-09-07
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.emerging-threats
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\svchost.exe'
        ImageLoaded|endswith: '\clfsw32.dll'
    condition: selection
falsepositives:
    - Rarely observed
level: high

title: BITS Transfer Job Download To Potential Suspicious Folder
id: f8a56cb7-a363-44ed-a82f-5926bb44cd05
status: test
description: Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
author: Florian Roth (Nextron Systems)
date: 2022-06-28
modified: 2023-03-27
tags:
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1197
logsource:
    product: windows
    service: bits-client
detection:
    selection:
        EventID: 16403
        LocalName|contains:
            # TODO: Add more interesting suspicious paths
            - '\Desktop\'
            - 'C:\Users\Public\'
            - 'C:\PerfLogs\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: CMSTP App Paths Registry Key Modification
id: b6d235fc-1d38-4b12-adbe-325f06728f37
status: stable
description: |
    Detects modifications to the CMSTP App Paths registry key. This may indicate abuse of
    Microsoft Connection Manager Profile Installer (CMSTP) for arbitrary code execution or UAC bypass.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/
    - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
    - https://web.archive.org/web/20190722224110/https://oddvar.moe/2017/08/15/research-on-cmstp-exe/
author: Nik Seetharaman
date: 2018-07-16
modified: 2026-08-27
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218.003
    - attack.g0069
    - car.2019-04-001
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\'
    filter_main_cmcfg32:
        TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe\CmstpExtensionDll'
        Details:
            - 'C:\Windows\System32\cmcfg32.dll'
            - 'C:\Windows\SysWOW64\cmcfg32.dll'
    filter_main_empty:
        Details: '(Empty)'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate CMSTP use (unlikely in modern enterprise environments)
level: high

title: Creation of WerFault.exe/Wer.dll in Unusual Folder
id: 28a452f3-786c-4fd8-b8f2-bddbe9d616d1
status: test
description: Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/
author: frack113
date: 2022-05-09
modified: 2026-05-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '\WerFault.exe'
            - '\wer.dll'
    filter_main_known_locations:
        TargetFilename|startswith:
            - 'C:\Windows\SoftwareDistribution\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\UUS\' # covers both C:\Windows\UUS\arm64\ and C:\Windows\UUS\packages\
    filter_main_process:
        Image|endswith: '\wuaucltcore.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

title: Cred Dump Tools Dropped Files
id: 8fbf3271-1ef6-4e94-8210-03c2317947f6
status: test
description: Files with well-known filenames (parts of credential dump software or files produced by them) creation
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
author: Teymur Kheirkhabarov, oscd.community
date: 2019-11-01
modified: 2025-10-25
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.002
    - attack.t1003.003
    - attack.t1003.004
    - attack.t1003.005
logsource:
    category: file_event
    product: windows
detection:
    selection:
        - TargetFilename|contains:
              - '\fgdump-log'
              - '\kirbi'
              - '\pwdump'
              - '\pwhashes'
              - '\wce_ccache'
              - '\wce_krbtkts'
        - TargetFilename|endswith:
              - '\cachedump.exe'
              - '\cachedump64.exe'
              - '\DumpExt.dll'
              - '\DumpSvc.exe'
              - '\Dumpy.exe'
              - '\fgexec.exe'
              - '\lsremora.dll'
              - '\lsremora64.dll'
              - '\NTDS.out'
              - '\procdump.exe'
              - '\procdump64.exe'
              - '\procdump64a.exe'
              - '\pstgdump.exe'
              - '\pwdump.exe'
              - '\SAM.out'
              - '\SECURITY.out'
              - '\servpw.exe'
              - '\servpw64.exe'
              - '\SYSTEM.out'
              - '\test.pwd'
              - '\wceaux.dll'
    condition: selection
falsepositives:
    - Legitimate Administrator using tool for password recovery
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files/info.yml

title: CVE-2022-24527 Microsoft Connected Cache LPE
id: e0a41412-c69a-446f-8e6e-0e6d7483dad7
status: test
description: Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache
references:
    - https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/
author: Florian Roth (Nextron Systems)
date: 2022-04-13
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.t1059.001
    - cve.2022-24527
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: 'WindowsPowerShell\Modules\webAdministration\webAdministration.psm1'
    filter:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: Disable Important Scheduled Task
id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
related:
    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
      type: similar
    - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog
      type: similar
status: test
description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
    - https://twitter.com/MichalKoczwara/status/1553634816016498688
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior
date: 2021-12-26
modified: 2026-03-11
tags:
    - attack.impact
    - attack.t1489
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_disable:
        CommandLine|contains|windash: '/disable'
    selection_cli_task:
        CommandLine|contains:
            # Add more important tasks
            - '\Windows\BitLocker'
            - '\Windows\ExploitGuard'
            - '\Windows\ExploitGuard\ExploitGuard MDM policy Refresh'
            - '\Windows\SystemRestore\SR'
            - '\Windows\UpdateOrchestrator\'
            - '\Windows\Windows Defender\'
            - '\Windows\WindowsBackup\'
            - '\Windows\WindowsUpdate\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml
simulation:
    - type: atomic-red-team
      name: Windows - Disable the SR scheduled task
      technique: T1490
      atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034

title: Disable Privacy Settings Experience in Registry
id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b
status: test
description: Detects registry modifications that disable Privacy Settings Experience
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md
author: frack113
date: 2022-10-02
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Legitimate admin script
level: medium
simulation:
    - type: atomic-red-team
      name: LockBit Black - Disable Privacy Settings Experience Using Registry -cmd
      technique: T1685
      atomic_guid: d6d22332-d07d-498f-aea0-6139ecb7850e
    - type: atomic-red-team
      name: LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell
      technique: T1685
      atomic_guid: d8c57eaa-497a-4a08-961e-bd5efd7c9374

title: DllUnregisterServer Function Call Via Msiexec.EXE
id: 84f52741-8834-4a8c-a413-2eb2269aa6c8
status: test
description: Detects MsiExec loading a DLL and calling its DllUnregisterServer function
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
    - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/
    - https://twitter.com/_st0pp3r_/status/1583914515996897281
author: frack113
date: 2022-04-24
modified: 2024-03-13
tags:
    - attack.stealth
    - attack.t1218.007
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\msiexec.exe'
        - OriginalFileName: '\msiexec.exe'
    selection_flag:
        CommandLine|contains|windash: ' -z '
    selection_dll:
        CommandLine|contains: '.dll'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_msiexec_dll/info.yml

title: Exchange transport agent injection via configuration file
description: Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
requirements: |
 requires to update SYSMON configuration to include the transport agent path (eg: '<TargetFilename condition="begin with">C:\Exchange2016\TransportRoles\Shared</TargetFilename>')
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505-Server%20Software%20Component
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
tags:
- attack.persistence
- attack.t1505.002 # Server Software Component: Transport Agent 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: file_event # Event ID 11
detection:
  selection:
    TargetFilename|endswith: '\TransportRoles\Shared\agents.config'
  filter:
    Image: '\ExchangeSetup\ExSetupUI.exe' # Exchange installer / updater
  condition: selection and not filter
falsepositives:
- rare administrator change
level: high

title: Exploiting SetupComplete.cmd CVE-2019-1378
id: 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
status: test
description: Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
references:
    - https://web.archive.org/web/20200530031708/https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
date: 2019-11-15
modified: 2021-11-27
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1068
    - attack.execution
    - attack.t1059.003
    - attack.t1574
    - cve.2019-1378
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentCommandLine|contains|all:
            - '\cmd.exe'
            - '/c'
            - 'C:\Windows\Setup\Scripts\'
        ParentCommandLine|endswith:
            - 'SetupComplete.cmd'
            - 'PartnerSetupComplete.cmd'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\Setup\'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: F5 BIG-IP iControl Rest API Command Execution - Proxy
id: b59c98c6-95e8-4d65-93ee-f594dfb96b17
related:
    - id: 85254a62-22be-4239-b79c-2ec17e566c37
      type: similar
status: test
description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
references:
    - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
    - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
    - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-11-08
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'POST'
        c-uri|endswith: '/mgmt/tm/util/bash'
    condition: selection
falsepositives:
    - Legitimate usage of the BIG IP REST API to execute command for administration purposes
level: medium

title: Invoke-Obfuscation Via Use Clip - Powershell
id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0
status: test
description: Detects Obfuscated Powershell via use Clip.exe in Scripts
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task29)
author: Nikita Nazarov, oscd.community
date: 2020-10-09
modified: 2024-04-15
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_4104:
        ScriptBlockText|re: '(?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

title: Java Payload Strings
id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c
status: test
description: Detects possible Java payloads in web access logs
references:
    - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
    - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
    - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
    - https://twitter.com/httpvoid0x2f/status/1532924261035384832
    - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
author: frack113, Harjot Singh, "@cyb3rjy0t" (update)
date: 2022-06-04
modified: 2023-01-19
tags:
    - cve.2022-26134
    - cve.2021-26084
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    keywords:
        - '%24%7B%28%23a%3D%40'
        - '${(#a=@'
        - '%24%7B%40java'
        - '${@java'
        - 'u0022java'
        - '%2F%24%7B%23'
        - '/${#'
        - 'new+java.'
        - 'getRuntime().exec('
        - 'getRuntime%28%29.exec%28'
    condition: keywords
falsepositives:
    - Legitimate apps
level: high

title: Kerberos TGS ticket request related to a potential Golden ticket
description: Detects scenarios where an attacker request a potential Golden ticket. Findings returned by this rule may not confirm at 100% that a Golden ticket was generated and further investigations would be required to confirm it. Another indicator (in case of a lazy Golden ticket) to check would be to check if the TargetUserName refers to an existing user in the domain.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1558-Steal%20or%20Forge%20Kerberos%20Tickets
- https://infosecwriteups.com/forest-an-asreproast-dcsync-and-golden-ticket-hackthebox-walkthrough-ade8dcdd1ee5
- https://attack.stealthbits.com/how-golden-ticket-attack-works
- https://www.hackingarticles.in/domain-persistence-golden-ticket-attack/
- https://adsecurity.org/?p=1515
- https://en.it-pirate.eu/azure-atp-golden-ticket-attack-how-golden-ticket-attacks-work/
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/kerberos-golden-tickets
- https://bond-o.medium.com/golden-ticket-attack-ea89553cf9c0
- https://www.blackhat.com/docs/us-15/materials/us-15-Metcalf-Red-Vs-Blue-Modern-Active-Directory-Attacks-Detection-And-Protection-wp.pdf
tags:
- attack.credential_access
- attack.t1558.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    TargetDomainName|re: <domain_in_lowercase.xxx> # adapt REGEXP according your SIEM
    TicketOptions:
      - 0x40810000
      - 0x60810010 # ServiceName: krbtgt
    TicketEncryptionType: 0x12
    Status: 0x0
  filter:
    IpAddress:
      - '::1'
      - '127.0.0.1'
      - '%domain_controllers_ips%' # reduce amount of false positives
  condition: selection and not filter
falsepositives:
- Unknown
level: high

title: Local group enumeration triggered by Azure Virtual machine recovery tool
description: Detects scenarios where an attacker having compromised a virtual machine via serial cable attempts to enumerate local groups.
references:
- https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial
tags:
- attack.discovery
- attack.t1069.001 # Permission Groups Discovery: Local Groups 
author: mdecrevoisier
status: stable
logsource:
  product: windows
  service: security
detection:
  selection: # C:\Packages\Plugins\Microsoft.Compute.VMAccessAgent\2.4.8\bin\JsonVMAccessExtension.exe
    EventID: 4799
    CallerProcessName|contains: 'Microsoft.Compute.VMAccessAgent'
  condition: selection
falsepositives:
- Virtual machine recovery by administrator 
level: high

title: Malicious Base64 Encoded PowerShell Keywords in Command Lines
id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0
status: test
description: Detects base64 encoded strings used in hidden malicious PowerShell command lines
references:
    - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/
author: John Lambert (rule)
date: 2019-01-16
modified: 2023-01-05
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_hidden:
        CommandLine|contains: ' hidden '
    selection_encoded:
        CommandLine|contains:
            - 'AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA'
            - 'aXRzYWRtaW4gL3RyYW5zZmVy'
            - 'IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA'
            - 'JpdHNhZG1pbiAvdHJhbnNmZX'
            - 'YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg'
            - 'Yml0c2FkbWluIC90cmFuc2Zlc'
            - 'AGMAaAB1AG4AawBfAHMAaQB6AGUA'
            - 'JABjAGgAdQBuAGsAXwBzAGkAegBlA'
            - 'JGNodW5rX3Npem'
            - 'QAYwBoAHUAbgBrAF8AcwBpAHoAZQ'
            - 'RjaHVua19zaXpl'
            - 'Y2h1bmtfc2l6Z'
            - 'AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A'
            - 'kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg'
            - 'lPLkNvbXByZXNzaW9u'
            - 'SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA'
            - 'SU8uQ29tcHJlc3Npb2'
            - 'Ty5Db21wcmVzc2lvb'
            - 'AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ'
            - 'kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA'
            - 'lPLk1lbW9yeVN0cmVhb'
            - 'SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A'
            - 'SU8uTWVtb3J5U3RyZWFt'
            - 'Ty5NZW1vcnlTdHJlYW'
            - '4ARwBlAHQAQwBoAHUAbgBrA'
            - '5HZXRDaHVua'
            - 'AEcAZQB0AEMAaAB1AG4Aaw'
            - 'LgBHAGUAdABDAGgAdQBuAGsA'
            - 'LkdldENodW5r'
            - 'R2V0Q2h1bm'
            - 'AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A'
            - 'QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA'
            - 'RIUkVBRF9JTkZPNj'
            - 'SFJFQURfSU5GTzY0'
            - 'VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA'
            - 'VEhSRUFEX0lORk82N'
            - 'AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA'
            - 'cmVhdGVSZW1vdGVUaHJlYW'
            - 'MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA'
            - 'NyZWF0ZVJlbW90ZVRocmVhZ'
            - 'Q3JlYXRlUmVtb3RlVGhyZWFk'
            - 'QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA'
            - '0AZQBtAG0AbwB2AGUA'
            - '1lbW1vdm'
            - 'AGUAbQBtAG8AdgBlA'
            - 'bQBlAG0AbQBvAHYAZQ'
            - 'bWVtbW92Z'
            - 'ZW1tb3Zl'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Network Connection Initiated To Cloudflared Tunnels Domains
id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
related:
    - id: a1d9eec5-33b2-4177-8d24-27fe754d0812
      type: derived
status: test
description: |
    Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
    Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
references:
    - https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/
    - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
    - Internal Research
author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)
date: 2024-05-27
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.t1567
    - attack.t1572
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith:
            - '.v2.argotunnel.com'
            - 'protocol-v2.argotunnel.com'
            - 'trycloudflare.com'
            - 'update.argotunnel.com'
    condition: selection
falsepositives:
    - Legitimate use of cloudflare tunnels will also trigger this.
level: medium

title: Number Of Resource Creation Or Deployment Activities
id: d2d901db-7a75-45a1-bc39-0cbf00812192
status: test
description: Number of VM creations or deployment activities occur in Azure via the azureactivity log.
references:
    - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
author: sawwinnnaung
date: 2020-05-07
modified: 2023-10-11
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: azure
    service: activitylogs
detection:
    keywords:
        - Microsoft.Compute/virtualMachines/write
        - Microsoft.Resources/deployments/write
    condition: keywords
falsepositives:
    - Valid change
level: medium

title: Potential Active Directory Enumeration Using AD Module - PsModule
id: 74176142-4684-4d8a-8b0a-713257e7df8e
related:
    - id: 70bc5215-526f-4477-963c-a47a5c9ebd12
      type: similar
    - id: 9e620995-f2d8-4630-8430-4afd89f77604
      type: similar
status: test
description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
references:
    - https://github.com/samratashok/ADModule
    - https://twitter.com/cyb3rops/status/1617108657166061568?s=20
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2023-01-22
tags:
    - attack.reconnaissance
    - attack.discovery
    - attack.impact
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_cmdlet:
        Payload|contains:
            - 'Import-Module '
            - 'ipmo '
    selection_dll:
        Payload|contains: 'Microsoft.ActiveDirectory.Management.dll'
    condition: all of selection_*
falsepositives:
    - Legitimate use of the library for administrative activity
level: medium

title: Potential COM Object Hijacking Via TreatAs Subkey - Registry
id: 9b0f8a61-91b2-464f-aceb-0527e0a45020
status: test
description: Detects COM object hijacking via TreatAs subkey
references:
    - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
author: Kutepov Anton, oscd.community
date: 2019-10-23
modified: 2025-10-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - 'HKU\'
            - 'Classes\CLSID\'
            - '\TreatAs'
    filter_main_svchost:
        # Example of target object by svchost
        # TargetObject: HKU\S-1-5-21-1098798288-3663759343-897484398-1001_Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs
        Image: 'C:\WINDOWS\system32\svchost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Maybe some system utilities in rare cases use linking keys for backward compatibility
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_com_key_linking/info.yml
simulation:
    - type: atomic-red-team
      name: COM hijacking via TreatAs
      technique: T1546.015
      atomic_guid: 33eacead-f117-4863-8eb0-5c6304fbfaa9

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '😀'
            - '😃'
            - '😄'
            - '😁'
            - '😆'
            - '😅'
            - '😂'
            - '🤣'
            - '🥲'
            - '🥹'
            - '☺️'
            - '😊'
            - '😇'
            - '🙂'
            - '🙃'
            - '😉'
            - '😌'
            - '😍'
            - '🥰'
            - '😘'
            - '😗'
            - '😙'
            - '😚'
            - '😋'
            - '😛'
            - '😝'
            - '😜'
            - '🤪'
            - '🤨'
            - '🧐'
            - '🤓'
            - '😎'
            - '🥸'
            - '🤩'
            - '🥳'
            - '😏'
            - '😒'
            - '😞'
            - '😔'
            - '😟'
            - '😕'
            - '🙁'
            - '☹️'
            - '😣'
            - '😖'
            - '😫'
            - '😩'
            - '🥺'
            - '😢'
            - '😭'
            - '😮‍💨'
            - '😤'
            - '😠'
            - '😡'
            - '🤬'
            - '🤯'
            - '😳'
            - '🥵'
            - '🥶'
            - '😱'
            - '😨'
            - '😰'
            - '😥'
            - '😓'
            - '🫣'
            - '🤗'
            - '🫡'
            - '🤔'
            - '🫢'
            - '🤭'
            - '🤫'
            - '🤥'
            - '😶'
            - '😶‍🌫️'
            - '😐'
            - '😑'
            - '😬'
            - '🫠'
            - '🙄'
            - '😯'
            - '😦'
            - '😧'
            - '😮'
            - '😲'
            - '🥱'
            - '😴'
            - '🤤'
            - '😪'
            - '😵'
            - '😵‍💫'
            - '🫥'
            - '🤐'
            - '🥴'
            - '🤢'
            - '🤮'
            - '🤧'
            - '😷'
            - '🤒'
            - '🤕'
            - '🤑'
            - '🤠'
            - '😈'
            - '👿'
            - '👹'
            - '👺'
            - '🤡'
            - '💩'
            - '👻'
            - '💀'
            - '☠️'
            - '👽'
            - '👾'
            - '🤖'
            - '🎃'
            - '😺'
            - '😸'
            - '😹'
            - '😻'
            - '😼'
            - '😽'
            - '🙀'
            - '😿'
            - '😾'
            - '👋'
            - '🤚'
            - '🖐'
            - '✋'
            - '🖖'
            - '👌'
            - '🤌'
            - '🤏'
            - '✌️'
            - '🤞'
            - '🫰'
            - '🤟'
            - '🤘'
            - '🤙'
            - '🫵'
            - '🫱'
            - '🫲'
            - '🫳'
            - '🫴'
            - '👈'
            - '👉'
            - '👆'
            - '🖕'
            - '👇'
            - '☝️'
            - '👍'
            - '👎'
            - '✊'
            - '👊'
            - '🤛'
            - '🤜'
            - '👏'
            - '🫶'
            - '🙌'
            - '👐'
            - '🤲'
            - '🤝'
            - '🙏'
            - '✍️'
            - '💪'
            - '🦾'
            - '🦵'
            - '🦿'
            - '🦶'
            - '👣'
            - '👂'
            - '🦻'
            - '👃'
            - '🫀'
            - '🫁'
            - '🧠'
            - '🦷'
            - '🦴'
            - '👀'
            - '👁'
            - '👅'
            - '👄'
            - '🫦'
            - '💋'
            - '🩸'
            - '👶'
            - '👧'
            - '🧒'
            - '👦'
            - '👩'
            - '🧑'
            - '👨'
            - '👩‍🦱'
            - '🧑‍🦱'
            - '👨‍🦱'
            - '👩‍🦰'
            - '🧑‍🦰'
            - '👨‍🦰'
            - '👱‍♀️'
            - '👱'
            - '👱‍♂️'
            - '👩‍🦳'
            - '🧑‍🦳'
            - '👨‍🦳'
            - '👩‍🦲'
            - '🧑‍🦲'
            - '👨‍🦲'
            - '🧔‍♀️'
            - '🧔'
            - '🧔‍♂️'
            - '👵'
            - '🧓'
            - '👴'
            - '👲'
            - '👳‍♀️'
            - '👳'
            - '👳‍♂️'
            - '🧕'
            - '👮‍♀️'
            - '👮'
            - '👮‍♂️'
            - '👷‍♀️'
            - '👷'
            - '👷‍♂️'
            - '💂‍♀️'
            - '💂'
            - '💂‍♂️'
            - '🕵️‍♀️'
            - '🕵️'
            - '🕵️‍♂️'
            - '👩‍⚕️'
            - '🧑‍⚕️'
            - '👨‍⚕️'
            - '👩‍🌾'
            - '🧑‍🌾'
            - '👨‍🌾'
            - '👩‍🍳'
            - '🧑‍🍳'
            - '👨‍🍳'
            - '👩‍🎓'
            - '🧑‍🎓'
            - '👨‍🎓'
            - '👩‍🎤'
            - '🧑‍🎤'
            - '👨‍🎤'
            - '👩‍🏫'
            - '🧑‍🏫'
            - '👨‍🏫'
            - '👩‍🏭'
            - '🧑‍🏭'
            - '👨‍🏭'
            - '👩‍💻'
            - '🧑‍💻'
            - '👨‍💻'
            - '👩‍💼'
            - '🧑‍💼'
            - '👨‍💼'
            - '👩‍🔧'
            - '🧑‍🔧'
            - '👨‍🔧'
            - '👩‍🔬'
            - '🧑‍🔬'
            - '👨‍🔬'
            - '👩‍🎨'
            - '🧑‍🎨'
            - '👨‍🎨'
            - '👩‍🚒'
            - '🧑‍🚒'
            - '👨‍🚒'
            - '👩‍✈️'
            - '🧑‍✈️'
            - '👨‍✈️'
            - '👩‍🚀'
            - '🧑‍🚀'
            - '👨‍🚀'
            - '👩‍⚖️'
            - '🧑‍⚖️'
            - '👨‍⚖️'
            - '👰‍♀️'
            - '👰'
            - '👰‍♂️'
            - '🤵‍♀️'
            - '🤵'
            - '🤵‍♂️'
            - '👸'
            - '🫅'
            - '🤴'
            - '🥷'
            - '🦸‍♀️'
            - '🦸'
            - '🦸‍♂️'
            - '🦹‍♀️'
            - '🦹'
            - '🦹‍♂️'
            - '🤶'
            - '🧑‍🎄'
            - '🎅'
            - '🧙‍♀️'
            - '🧙'
            - '🧙‍♂️'
            - '🧝‍♀️'
            - '🧝'
            - '🧝‍♂️'
            - '🧛‍♀️'
            - '🧛'
            - '🧛‍♂️'
            - '🧟‍♀️'
            - '🧟'
            - '🧟‍♂️'
            - '🧞‍♀️'
            - '🧞'
            - '🧞‍♂️'
            - '🧜‍♀️'
            - '🧜'
            - '🧜‍♂️'
            - '🧚‍♀️'
            - '🧚'
            - '🧚‍♂️'
            - '🧌'
            - '👼'
            - '🤰'
            - '🫄'
            - '🫃'
            - '🤱'
            - '👩‍🍼'
            - '🧑‍🍼'
            - '👨‍🍼'
            - '🙇‍♀️'
            - '🙇'
            - '🙇‍♂️'
            - '💁‍♀️'
            - '💁'
            - '💁‍♂️'
            - '🙅‍♀️'
            - '🙅'
            - '🙅‍♂️'
            - '🙆‍♀️'
            - '🙆'
            - '🙆‍♂️'
            - '🙋‍♀️'
            - '🙋'
            - '🙋‍♂️'
            - '🧏‍♀️'
            - '🧏'
            - '🧏‍♂️'
            - '🤦‍♀️'
            - '🤦'
            - '🤦‍♂️'
            - '🤷‍♀️'
            - '🤷'
            - '🤷‍♂️'
            - '🙎‍♀️'
            - '🙎'
            - '🙎‍♂️'
            - '🙍‍♀️'
            - '🙍'
            - '🙍‍♂️'
            - '💇‍♀️'
            - '💇'
            - '💇‍♂️'
            - '💆‍♀️'
            - '💆'
            - '💆‍♂️'
            - '🧖‍♀️'
            - '🧖'
            - '🧖‍♂️'
            - '💅'
            - '💃'
            - '🕺'
            - '👯‍♀️'
            - '👯'
            - '👯‍♂️'
            - '🕴'
            - '👩‍🦽'
            - '🧑‍🦽'
            - '👨‍🦽'
            - '👩‍🦼'
            - '🧑‍🦼'
            - '👨‍🦼'
            - '🚶‍♀️'
            - '🚶'
            - '🚶‍♂️'
            - '👩‍🦯'
            - '🧑‍🦯'
            - '👨‍🦯'
            - '🧎‍♀️'
            - '🧎'
            - '🧎‍♂️'
            - '🏃‍♀️'
            - '🏃'
            - '🏃‍♂️'
            - '🧍‍♀️'
            - '🧍'
            - '🧍‍♂️'
            - '👭'
            - '🧑‍🤝‍🧑'
            - '👬'
            - '👫'
            - '👩‍❤️‍👩'
            - '💑'
            - '👨‍❤️‍👨'
            - '👩‍❤️‍👨'
            - '👩‍❤️‍💋‍👩'
            - '💏'
            - '👨‍❤️‍💋‍👨'
            - '👩‍❤️‍💋‍👨'
            - '👪'
            - '👨‍👩‍👦'
            - '👨‍👩‍👧'
            - '👨‍👩‍👧‍👦'
            - '👨‍👩‍👦‍👦'
            - '👨‍👩‍👧‍👧'
            - '👨‍👨‍👦'
            - '👨‍👨‍👧'
            - '👨‍👨‍👧‍👦'
            - '👨‍👨‍👦‍👦'
            - '👨‍👨‍👧‍👧'
            - '👩‍👩‍👦'
            - '👩‍👩‍👧'
            - '👩‍👩‍👧‍👦'
            - '👩‍👩‍👦‍👦'
            - '👩‍👩‍👧‍👧'
            - '👨‍👦'
            - '👨‍👦‍👦'
            - '👨‍👧'
            - '👨‍👧‍👦'
            - '👨‍👧‍👧'
            - '👩‍👦'
            - '👩‍👦‍👦'
            - '👩‍👧'
            - '👩‍👧‍👦'
            - '👩‍👧‍👧'
            - '🗣'
            - '👤'
            - '👥'
            - '🫂'
            - '🧳'
            - '🌂'
            - '☂️'
            - '🧵'
            - '🪡'
            - '🪢'
            - '🧶'
            - '👓'
            - '🕶'
            - '🥽'
            - '🥼'
            - '🦺'
            - '👔'
            - '👕'
            - '👖'
            - '🧣'
            - '🧤'
            - '🧥'
            - '🧦'
            - '👗'
            - '👘'
            - '🥻'
            - '🩴'
            - '🩱'
            - '🩲'
            - '🩳'
            - '👙'
            - '👚'
            - '👛'
            - '👜'
            - '👝'
            - '🎒'
            - '👞'
            - '👟'
            - '🥾'
            - '🥿'
            - '👠'
            - '👡'
            - '🩰'
            - '👢'
            - '👑'
            - '👒'
            - '🎩'
            - '🎓'
            - '🧢'
            - '⛑'
            - '🪖'
            - '💄'
            - '💍'
            - '💼'
            - '👋🏻'
            - '🤚🏻'
            - '🖐🏻'
            - '✋🏻'
            - '🖖🏻'
            - '👌🏻'
            - '🤌🏻'
            - '🤏🏻'
            - '✌🏻'
            - '🤞🏻'
            - '🫰🏻'
            - '🤟🏻'
            - '🤘🏻'
            - '🤙🏻'
            - '🫵🏻'
            - '🫱🏻'
            - '🫲🏻'
            - '🫳🏻'
            - '🫴🏻'
            - '👈🏻'
            - '👉🏻'
            - '👆🏻'
            - '🖕🏻'
            - '👇🏻'
            - '☝🏻'
            - '👍🏻'
            - '👎🏻'
            - '✊🏻'
            - '👊🏻'
            - '🤛🏻'
            - '🤜🏻'
            - '👏🏻'
            - '🫶🏻'
            - '🙌🏻'
            - '👐🏻'
            - '🤲🏻'
            - '🙏🏻'
            - '✍🏻'
            - '💪🏻'
            - '🦵🏻'
            - '🦶🏻'
            - '👂🏻'
            - '🦻🏻'
            - '👃🏻'
            - '👶🏻'
            - '👧🏻'
            - '🧒🏻'
            - '👦🏻'
            - '👩🏻'
            - '🧑🏻'
            - '👨🏻'
            - '👩🏻‍🦱'
            - '🧑🏻‍🦱'
            - '👨🏻‍🦱'
            - '👩🏻‍🦰'
            - '🧑🏻‍🦰'
            - '👨🏻‍🦰'
            - '👱🏻‍♀️'
            - '👱🏻'
            - '👱🏻‍♂️'
            - '👩🏻‍🦳'
            - '🧑🏻‍🦳'
            - '👨🏻‍🦳'
            - '👩🏻‍🦲'
            - '🧑🏻‍🦲'
            - '👨🏻‍🦲'
            - '🧔🏻‍♀️'
            - '🧔🏻'
            - '🧔🏻‍♂️'
            - '👵🏻'
            - '🧓🏻'
            - '👴🏻'
            - '👲🏻'
            - '👳🏻‍♀️'
            - '👳🏻'
            - '👳🏻‍♂️'
            - '🧕🏻'
            - '👮🏻‍♀️'
            - '👮🏻'
            - '👮🏻‍♂️'
            - '👷🏻‍♀️'
            - '👷🏻'
            - '👷🏻‍♂️'
            - '💂🏻‍♀️'
            - '💂🏻'
            - '💂🏻‍♂️'
            - '🕵🏻‍♀️'
            - '🕵🏻'
            - '🕵🏻‍♂️'
            - '👩🏻‍⚕️'
            - '🧑🏻‍⚕️'
            - '👨🏻‍⚕️'
            - '👩🏻‍🌾'
            - '🧑🏻‍🌾'
            - '👨🏻‍🌾'
            - '👩🏻‍🍳'
            - '🧑🏻‍🍳'
            - '👨🏻‍🍳'
            - '👩🏻‍🎓'
            - '🧑🏻‍🎓'
            - '👨🏻‍🎓'
            - '👩🏻‍🎤'
            - '🧑🏻‍🎤'
            - '👨🏻‍🎤'
            - '👩🏻‍🏫'
            - '🧑🏻‍🏫'
            - '👨🏻‍🏫'
            - '👩🏻‍🏭'
            - '🧑🏻‍🏭'
            - '👨🏻‍🏭'
            - '👩🏻‍💻'
            - '🧑🏻‍💻'
            - '👨🏻‍💻'
            - '👩🏻‍💼'
            - '🧑🏻‍💼'
            - '👨🏻‍💼'
            - '👩🏻‍🔧'
            - '🧑🏻‍🔧'
            - '👨🏻‍🔧'
            - '👩🏻‍🔬'
            - '🧑🏻‍🔬'
            - '👨🏻‍🔬'
            - '👩🏻‍🎨'
            - '🧑🏻‍🎨'
            - '👨🏻‍🎨'
            - '👩🏻‍🚒'
            - '🧑🏻‍🚒'
            - '👨🏻‍🚒'
            - '👩🏻‍✈️'
            - '🧑🏻‍✈️'
            - '👨🏻‍✈️'
            - '👩🏻‍🚀'
            - '🧑🏻‍🚀'
            - '👨🏻‍🚀'
            - '👩🏻‍⚖️'
            - '🧑🏻‍⚖️'
            - '👨🏻‍⚖️'
            - '👰🏻‍♀️'
            - '👰🏻'
            - '👰🏻‍♂️'
            - '🤵🏻‍♀️'
            - '🤵🏻'
            - '🤵🏻‍♂️'
            - '👸🏻'
            - '🫅🏻'
            - '🤴🏻'
            - '🥷🏻'
            - '🦸🏻‍♀️'
            - '🦸🏻'
            - '🦸🏻‍♂️'
            - '🦹🏻‍♀️'
            - '🦹🏻'
            - '🦹🏻‍♂️'
            - '🤶🏻'
            - '🧑🏻‍🎄'
            - '🎅🏻'
            - '🧙🏻‍♀️'
            - '🧙🏻'
            - '🧙🏻‍♂️'
            - '🧝🏻‍♀️'
            - '🧝🏻'
            - '🧝🏻‍♂️'
            - '🧛🏻‍♀️'
            - '🧛🏻'
            - '🧛🏻‍♂️'
            - '🧜🏻‍♀️'
            - '🧜🏻'
            - '🧜🏻‍♂️'
            - '🧚🏻‍♀️'
            - '🧚🏻'
            - '🧚🏻‍♂️'
            - '👼🏻'
            - '🤰🏻'
            - '🫄🏻'
            - '🫃🏻'
            - '🤱🏻'
            - '👩🏻‍🍼'
            - '🧑🏻‍🍼'
            - '👨🏻‍🍼'
            - '🙇🏻‍♀️'
            - '🙇🏻'
            - '🙇🏻‍♂️'
            - '💁🏻‍♀️'
            - '💁🏻'
            - '💁🏻‍♂️'
            - '🙅🏻‍♀️'
            - '🙅🏻'
            - '🙅🏻‍♂️'
            - '🙆🏻‍♀️'
            - '🙆🏻'
            - '🙆🏻‍♂️'
            - '🙋🏻‍♀️'
            - '🙋🏻'
            - '🙋🏻‍♂️'
            - '🧏🏻‍♀️'
            - '🧏🏻'
            - '🧏🏻‍♂️'
            - '🤦🏻‍♀️'
            - '🤦🏻'
            - '🤦🏻‍♂️'
            - '🤷🏻‍♀️'
            - '🤷🏻'
            - '🤷🏻‍♂️'
            - '🙎🏻‍♀️'
            - '🙎🏻'
            - '🙎🏻‍♂️'
            - '🙍🏻‍♀️'
            - '🙍🏻'
            - '🙍🏻‍♂️'
            - '💇🏻‍♀️'
            - '💇🏻'
            - '💇🏻‍♂️'
            - '💆🏻‍♀️'
            - '💆🏻'
            - '💆🏻‍♂️'
            - '🧖🏻‍♀️'
            - '🧖🏻'
            - '🧖🏻‍♂️'
            - '💃🏻'
            - '🕺🏻'
            - '🕴🏻'
            - '👩🏻‍🦽'
            - '🧑🏻‍🦽'
            - '👨🏻‍🦽'
            - '👩🏻‍🦼'
            - '🧑🏻‍🦼'
            - '👨🏻‍🦼'
            - '🚶🏻‍♀️'
            - '🚶🏻'
            - '🚶🏻‍♂️'
            - '👩🏻‍🦯'
            - '🧑🏻‍🦯'
            - '👨🏻‍🦯'
            - '🧎🏻‍♀️'
            - '🧎🏻'
            - '🧎🏻‍♂️'
            - '🏃🏻‍♀️'
            - '🏃🏻'
            - '🏃🏻‍♂️'
            - '🧍🏻‍♀️'
            - '🧍🏻'
            - '🧍🏻‍♂️'
            - '👭🏻'
            - '🧑🏻‍🤝‍🧑🏻'
            - '👬🏻'
            - '👫🏻'
            - '🧗🏻‍♀️'
            - '🧗🏻'
            - '🧗🏻‍♂️'
            - '🏇🏻'
            - '🏂🏻'
            - '🏌🏻‍♀️'
            - '🏌🏻'
            - '🏌🏻‍♂️'
            - '🏄🏻‍♀️'
            - '🏄🏻'
            - '🏄🏻‍♂️'
            - '🚣🏻‍♀️'
            - '🚣🏻'
            - '🚣🏻‍♂️'
            - '🏊🏻‍♀️'
            - '🏊🏻'
            - '🏊🏻‍♂️'
            - '⛹🏻‍♀️'
            - '⛹🏻'
            - '⛹🏻‍♂️'
            - '🏋🏻‍♀️'
            - '🏋🏻'
            - '🏋🏻‍♂️'
            - '🚴🏻‍♀️'
            - '🚴🏻'
            - '🚴🏻‍♂️'
            - '🚵🏻‍♀️'
            - '🚵🏻'
            - '🚵🏻‍♂️'
            - '🤸🏻‍♀️'
            - '🤸🏻'
            - '🤸🏻‍♂️'
            - '🤽🏻‍♀️'
            - '🤽🏻'
            - '🤽🏻‍♂️'
            - '🤾🏻‍♀️'
            - '🤾🏻'
            - '🤾🏻‍♂️'
            - '🤹🏻‍♀️'
            - '🤹🏻'
            - '🤹🏻‍♂️'
            - '🧘🏻‍♀️'
            - '🧘🏻'
            - '🧘🏻‍♂️'
            - '🛀🏻'
            - '🛌🏻'
            - '👋🏼'
            - '🤚🏼'
            - '🖐🏼'
            - '✋🏼'
            - '🖖🏼'
            - '👌🏼'
            - '🤌🏼'
            - '🤏🏼'
            - '✌🏼'
            - '🤞🏼'
            - '🫰🏼'
            - '🤟🏼'
            - '🤘🏼'
            - '🤙🏼'
            - '🫵🏼'
            - '🫱🏼'
            - '🫲🏼'
            - '🫳🏼'
            - '🫴🏼'
            - '👈🏼'
            - '👉🏼'
            - '👆🏼'
            - '🖕🏼'
            - '👇🏼'
            - '☝🏼'
            - '👍🏼'
            - '👎🏼'
            - '✊🏼'
            - '👊🏼'
            - '🤛🏼'
            - '🤜🏼'
            - '👏🏼'
            - '🫶🏼'
            - '🙌🏼'
            - '👐🏼'
            - '🤲🏼'
            - '🙏🏼'
            - '✍🏼'
            - '💪🏼'
            - '🦵🏼'
            - '🦶🏼'
            - '👂🏼'
            - '🦻🏼'
            - '👃🏼'
            - '👶🏼'
            - '👧🏼'
            - '🧒🏼'
            - '👦🏼'
            - '👩🏼'
            - '🧑🏼'
            - '👨🏼'
            - '👩🏼‍🦱'
            - '🧑🏼‍🦱'
            - '👨🏼‍🦱'
            - '👩🏼‍🦰'
            - '🧑🏼‍🦰'
            - '👨🏼‍🦰'
            - '👱🏼‍♀️'
            - '👱🏼'
            - '👱🏼‍♂️'
            - '👩🏼‍🦳'
            - '🧑🏼‍🦳'
            - '👨🏼‍🦳'
            - '👩🏼‍🦲'
            - '🧑🏼‍🦲'
            - '👨🏼‍🦲'
            - '🧔🏼‍♀️'
            - '🧔🏼'
            - '🧔🏼‍♂️'
            - '👵🏼'
            - '🧓🏼'
            - '👴🏼'
            - '👲🏼'
            - '👳🏼‍♀️'
            - '👳🏼'
            - '👳🏼‍♂️'
            - '🧕🏼'
            - '👮🏼‍♀️'
            - '👮🏼'
            - '👮🏼‍♂️'
            - '👷🏼‍♀️'
            - '👷🏼'
            - '👷🏼‍♂️'
            - '💂🏼‍♀️'
            - '💂🏼'
            - '💂🏼‍♂️'
            - '🕵🏼‍♀️'
            - '🕵🏼'
            - '🕵🏼‍♂️'
            - '👩🏼‍⚕️'
            - '🧑🏼‍⚕️'
            - '👨🏼‍⚕️'
            - '👩🏼‍🌾'
            - '🧑🏼‍🌾'
            - '👨🏼‍🌾'
            - '👩🏼‍🍳'
            - '🧑🏼‍🍳'
            - '👨🏼‍🍳'
            - '👩🏼‍🎓'
            - '🧑🏼‍🎓'
            - '👨🏼‍🎓'
            - '👩🏼‍🎤'
            - '🧑🏼‍🎤'
            - '👨🏼‍🎤'
            - '👩🏼‍🏫'
            - '🧑🏼‍🏫'
            - '👨🏼‍🏫'
            - '👩🏼‍🏭'
            - '🧑🏼‍🏭'
            - '👨🏼‍🏭'
            - '👩🏼‍💻'
            - '🧑🏼‍💻'
            - '👨🏼‍💻'
            - '👩🏼‍💼'
            - '🧑🏼‍💼'
            - '👨🏼‍💼'
            - '👩🏼‍🔧'
            - '🧑🏼‍🔧'
            - '👨🏼‍🔧'
            - '👩🏼‍🔬'
            - '🧑🏼‍🔬'
            - '👨🏼‍🔬'
            - '👩🏼‍🎨'
            - '🧑🏼‍🎨'
            - '👨🏼‍🎨'
            - '👩🏼‍🚒'
            - '🧑🏼‍🚒'
            - '👨🏼‍🚒'
            - '👩🏼‍✈️'
            - '🧑🏼‍✈️'
            - '👨🏼‍✈️'
            - '👩🏼‍🚀'
            - '🧑🏼‍🚀'
            - '👨🏼‍🚀'
            - '👩🏼‍⚖️'
            - '🧑🏼‍⚖️'
            - '👨🏼‍⚖️'
            - '👰🏼‍♀️'
            - '👰🏼'
            - '👰🏼‍♂️'
            - '🤵🏼‍♀️'
            - '🤵🏼'
            - '🤵🏼‍♂️'
            - '👸🏼'
            - '🫅🏼'
            - '🤴🏼'
            - '🥷🏼'
            - '🦸🏼‍♀️'
            - '🦸🏼'
            - '🦸🏼‍♂️'
            - '🦹🏼‍♀️'
            - '🦹🏼'
            - '🦹🏼‍♂️'
            - '🤶🏼'
            - '🧑🏼‍🎄'
            - '🎅🏼'
            - '🧙🏼‍♀️'
            - '🧙🏼'
            - '🧙🏼‍♂️'
            - '🧝🏼‍♀️'
            - '🧝🏼'
            - '🧝🏼‍♂️'
            - '🧛🏼‍♀️'
            - '🧛🏼'
            - '🧛🏼‍♂️'
            - '🧜🏼‍♀️'
            - '🧜🏼'
            - '🧜🏼‍♂️'
            - '🧚🏼‍♀️'
            - '🧚🏼'
            - '🧚🏼‍♂️'
            - '👼🏼'
            - '🤰🏼'
            - '🫄🏼'
            - '🫃🏼'
            - '🤱🏼'
            - '👩🏼‍🍼'
            - '🧑🏼‍🍼'
            - '👨🏼‍🍼'
            - '🙇🏼‍♀️'
            - '🙇🏼'
            - '🙇🏼‍♂️'
            - '💁🏼‍♀️'
            - '💁🏼'
            - '💁🏼‍♂️'
            - '🙅🏼‍♀️'
            - '🙅🏼'
            - '🙅🏼‍♂️'
            - '🙆🏼‍♀️'
            - '🙆🏼'
            - '🙆🏼‍♂️'
            - '🙋🏼‍♀️'
            - '🙋🏼'
            - '🙋🏼‍♂️'
            - '🧏🏼‍♀️'
            - '🧏🏼'
            - '🧏🏼‍♂️'
            - '🤦🏼‍♀️'
            - '🤦🏼'
            - '🤦🏼‍♂️'
            - '🤷🏼‍♀️'
    condition: selection
falsepositives:
    - Unknown
level: high