alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass au
Matching passage: Sigma rule: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass au. Logsource: azure / auditlogs. Rule: title: Disabled MFA to Bypass Authentication Mechanisms id: 7ea78478-a4f9-42a6-9dcd-f861816122bf status: test description: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms. references: - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/ - https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/ - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user author: '@ionsor' date: 2022-02-08 modified: 2026-04-30 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: operationName: Disable Strong Authentication properties.result: success condition: selection falsepositives: - Authorized modification by administrators level: medium
Near-miss passage: Sigma rule: Detects a suspicious WinRAR execution in a folder which is not the default installation folder. Logsource: windows / process_creation. Rule: title: WinRAR Execution in Non-Standard Folder id: 4ede543c-e098-43d9-a28f-dd784a13132f status: test description: Detects a suspicious WinRAR execution in a folder which is not the default installation folder references: - https://twitter.com/cyb3rops/status/1460978167628406785 author: Florian Roth (Nextron Systems), Tigzy date: 2021-11-17 modified: 2025-07-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rar.exe - \winrar.exe - Description: - Command line RAR - WinRAR filter_main_unrar: Image|endswith: \UnRAR.exe filter_main_path: Image|contains: - :\Program Files (x86)\WinRAR\ - :\Program Files\WinRAR\ filter_optional_temp: Image|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate use of WinRAR in a folder of a software that bundles WinRAR level: medium
Query: SOC alert related to Query Registry
Matching passage: T1012 Query Registry. Tactics: discovery. Description: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Near-miss passage: T1680 Local Storage Discovery. Tactics: discovery. Description: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware) On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity) Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Query: describe CVE-2015-1922
Matching passage: CVE-2015-1922. CWE: CWE-284. CVSS: 3.5. The Data Movement implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to bypass intended access restrictions and delete table rows via unspecified vectors.
Near-miss passage: CVE-2015-3671. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly verify XPC entitlements, which allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Matching passage: CVE-2015-9049. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Near-miss passage: CVE-2015-9061. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.
Query: risk of Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.
Matching passage: CVE-2015-7007. CWE: UNKNOWN. CVSS: 7.5. Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.
Near-miss passage: CVE-2015-0451. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 3.0-04 allows remote authenticated users to affect confidentiality via vectors related to OpenSSO Web Agents.
Query: patch priority for CVE-2015-1165
Matching passage: CVE-2015-1165. CWE: CWE-200. CVSS: 5.0. RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Near-miss passage: CVE-2015-4996. CWE: CWE-200. CVSS: 5.099999904632568. IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors.
Query: hunt for Server activity
Matching passage: T1583.004 Server. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
Near-miss passage: T1583.007 Serverless. Tactics: resource development. Description: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
Query: CVE similar to CVE-2015-2509
Matching passage: CVE-2015-2509. CWE: CWE-284. CVSS: 9.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."
Near-miss passage: CVE-2015-3306. CWE: CWE-284. CVSS: 10.0. The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Query: risk of ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.
Matching passage: CVE-2015-7788. CWE: CWE-264. CVSS: 7.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.
Near-miss passage: CVE-2015-1703. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1704.
Query: CWE for finalize() Method Without super.finalize()
Matching passage: CWE-568 finalize() Method Without super.finalize(). The product contains a finalize() method that does not call super.finalize().
Near-miss passage: CWE-115 Misinterpretation of Input. The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Query: risk of SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Matching passage: CVE-2015-4426. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Near-miss passage: CVE-2015-10100. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
Query: detection rule: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set
Matching passage: Sigma rule: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set. Logsource: windows / msexchange-management. Rule: title: ProxyLogon MSExchange OabVirtualDirectory id: 550d3350-bb8a-4ff3-9533-2ba533f4a1c0 status: test description: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory references: - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c author: Florian Roth (Nextron Systems) date: 2021-08-09 modified: 2023-01-23 tags: - attack.t1587.001 - attack.resource-development logsource: product: windows service: msexchange-management detection: keywords_cmdlet: '|all': - OabVirtualDirectory - ' -ExternalUrl ' keywords_params: - eval(request - http://f/<script - '"unsafe"};' - function Page_Load() condition: keywords_cmdlet and keywords_params falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects default RemCom pipe creation. Logsource: windows / pipe_created. Rule: title: PUA - RemCom Default Named Pipe id: d36f87ea-c403-44d2-aa79-1a0ac7c24456 related: - id: 9e77ed63-2ecf-4c7b-b09d-640834882028 type: obsolete status: test description: Detects default RemCom pipe creation references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://github.com/kavika13/RemCom author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 modified: 2023-11-30 tags: - attack.lateral-movement - attack.t1021.002 - attack.execution - attack.t1569.002 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \RemCom condition: selection falsepositives: - Legitimate Administrator activity level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Matching passage: CVE-2015-8477. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Near-miss passage: CVE-2015-5654. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: write Sigma for Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container
Matching passage: Sigma rule: Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container. Logsource: kubernetes / application / audit. Rule: title: Potential Sidecar Injection Into Running Deployment id: ad9012a6-e518-4432-9890-f3b82b8fc71f status: test description: 'Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster. ' references: - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1609 - attack.execution logsource: category: application product: kubernetes service: audit detection: selection: verb: patch apiGroup: apps objectRef.resource: deployments condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.. Logsource: windows / process_creation. Rule: title: DLL Loaded via CertOC.EXE id: 242301bc-f92f-4476-8718-78004a6efd9f related: - id: 84232095-ecca-4015-b0d7-7726507ee793 type: similar status: test description: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. references: - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20 - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2 - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Austin Songer @austinsonger date: 2021-10-23 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|windash: ' -LoadDLL ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-5849
Matching passage: CVE-2015-5849. CWE: CWE-264. CVSS: 6.800000190734863. The filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to send events to a different user, which allows attackers to bypass intended access restrictions by leveraging a screen-sharing connection.
Near-miss passage: CVE-2015-5043. CWE: CWE-264. CVSS: 7.199999809265137. diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences.
Query: patch priority for CVE-2015-3691
Matching passage: CVE-2015-3691. CWE: CWE-284. CVSS: 9.300000190734863. The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer.
Near-miss passage: CVE-2015-8627. CWE: CWE-284. CVSS: 5.300000190734863. MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Query: vulnerability: The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Matching passage: CVE-2015-2776. CWE: CWE-20. CVSS: 4.300000190734863. The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Near-miss passage: CVE-2015-8562. CWE: CWE-20. CVSS: 7.5. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Query: alert when Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Matching passage: Sigma rule: Execution of ssh.exe to perform data exfiltration and tunneling through RDP. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via SSH id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d related: - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da type: similar status: test description: Execution of ssh.exe to perform data exfiltration and tunneling through RDP references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2023-01-25 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains: :3389 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via App. Logsource: windows / process_creation. Rule: title: Potential File Download Via MS-AppInstaller Protocol Handler id: 180c7c5c-d64b-4a63-86e9-68910451bc8b related: - id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a type: derived status: test description: 'Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>" ' references: - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ms-appinstaller://?source= - http condition: selection falsepositives: - Unknown level: medium