alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are
Matching passage: Sigma rule: Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are. Logsource: zeek / dce_rpc. Rule: title: Potential PetitPotam Attack Via EFS RPC Calls id: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a status: test description: "Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this\ \ RPC are used within the attack refereed to as PetitPotam.\nThe usage of this RPC function should be rare if ever used\ \ at all.\nThus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation\ \ to determine if it is legitimate.\n View surrounding logs (within a few minutes before and after) from the Source IP to.\ \ Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'\n" references: - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003 - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf - https://threatpost.com/microsoft-petitpotam-poc/168163/ author: '@neu5ron, @Antonlovesdnb, Mike Remen' date: 2021-08-17 modified: 2022-11-28 tags: - attack.collection - attack.credential-access - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dce_rpc detection: selection: operation|startswith: efs condition: selection falsepositives: - Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description). level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed office binary. Logsource: windows / process_creation. Rule: title: Renamed Office Binary Execution id: 0b0cd537-fc77-4e6e-a973-e53495c1083d status: test description: Detects the execution of a renamed office binary references: - https://infosec.exchange/@sbousseaden/109542254124022664 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-20 modified: 2025-12-09 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: - Excel.exe - MSACCESS.EXE - MSPUB.EXE - OneNote.exe - OneNoteM.exe - OUTLOOK.EXE - POWERPNT.EXE - WinWord.exe - Olk.exe - Description: - Microsoft Access - Microsoft Excel - Microsoft OneNote - Microsoft Outlook - Microsoft PowerPoint - Microsoft Publisher - Microsoft Word - Sent to OneNote Tool filter_main_legit_names: Image|endswith: - \EXCEL.exe - \excelcnv.exe - \MSACCESS.exe - \MSPUB.EXE - \ONENOTE.EXE - \ONENOTEM.EXE - \OUTLOOK.EXE - \POWERPNT.EXE - \WINWORD.exe - \OLK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: intelligence brief on T1104
Matching passage: T1104 Multi-Stage Channels. Tactics: command and control. Description: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features. The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or [Fallback Channels](https://attack.mitre.org/techniques/T1008) in case the original first-stage communication path is discovered and blocked.
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: patch priority for CVE-2015-7504
Matching passage: CVE-2015-7504. CWE: CWE-787. CVSS: 8.800000190734863. Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
Near-miss passage: CVE-2015-5628. CWE: CWE-787. CVSS: 9.800000190734863. Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.
Query: exploit The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trig
Matching passage: CVE-2015-3844. CWE: CWE-264. CVSS: 6.800000190734863. The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Near-miss passage: CVE-2015-5511. CWE: CWE-264. CVSS: 5.0. The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login.
Query: patch priority for CVE-2015-9397
Matching passage: CVE-2015-9397. CWE: CWE-79. CVSS: 5.400000095367432. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Near-miss passage: CVE-2015-4706. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Query: rule covering Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde
Matching passage: Sigma rule: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde. Logsource: windows / process_creation. Rule: title: Unmount Share Via Net.EXE id: cb7c4a03-2871-43c0-9bbb-18bbdb079896 status: test description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-08 modified: 2023-02-21 tags: - attack.stealth - attack.t1070.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - share - /delete condition: all of selection* falsepositives: - Administrators or Power users may remove their shares via cmd line level: low
Near-miss passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Query: Lateral movement indicators for Cloud Services
Matching passage: T1021.007 Cloud Services. Tactics: lateral movement. Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.
Near-miss passage: T1021.002 SMB/Windows Admin Shares. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba. Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)
Query: detection rule: Detects Base64 encoded Shellcode
Matching passage: Sigma rule: Detects Base64 encoded Shellcode. Logsource: windows / ps_script. Rule: title: PowerShell ShellCode id: 16b37b70-6fcf-4814-a092-c36bd3aafcbd status: test description: Detects Base64 encoded Shellcode references: - https://twitter.com/cyb3rops/status/1063072865992523776 author: David Ledbetter (shellcode), Florian Roth (Nextron Systems) date: 2018-11-17 modified: 2024-01-25 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - OiCAAAAYInlM - OiJAAAAYInlM condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the. Logsource: linux / auditd. Rule: title: Suspicious C2 Activities id: f7158a64-6204-4d6d-868a-6e6378b467e0 status: test description: 'Detects suspicious activities as declared by Florian Roth in its ''Best Practice Auditd Configuration''. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132) ' references: - https://github.com/Neo23x0/auditd author: Marie Euler date: 2020-05-18 modified: 2021-11-27 tags: - attack.command-and-control logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /usr/bin/wget -p x -k susp_activity -w /usr/bin/curl -p x -k susp_activity -w /usr/bin/base64 -p x -k susp_activity -w /bin/nc -p x -k susp_activity -w /bin/netcat -p x -k susp_activity -w /usr/bin/ncat -p x -k susp_activity -w /usr/bin/ss -p x -k susp_activity -w /usr/bin/netstat -p x -k susp_activity -w /usr/bin/ssh -p x -k susp_activity -w /usr/bin/scp -p x -k susp_activity -w /usr/bin/sftp -p x -k susp_activity -w /usr/bin/ftp -p x -k susp_activity -w /usr/bin/socat -p x -k susp_activity -w /usr/bin/wireshark -p x -k susp_activity -w /usr/bin/tshark -p x -k susp_activity -w /usr/bin/rawshark -p x -k susp_activity -w /usr/bin/rdesktop -p x -k susp_activity -w /usr/local/bin/rdesktop -p x -k susp_activity -w /usr/bin/wlfreerdp -p x -k susp_activity -w /usr/bin/xfreerdp -p x -k susp_activity -w /usr/local/bin/xfreerdp -p x -k susp_activity -w /usr/bin/nmap -p x -k susp_activity (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336) ' detection: selection: key: susp_activity condition: selection falsepositives: - Admin or User activity level: medium
Query: risk of epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of servi
Matching passage: CVE-2015-3810. CWE: CWE-399. CVSS: 7.800000190734863. epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.
Near-miss passage: CVE-2015-5332. CWE: CWE-399. CVSS: 6.800000190734863. Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.
Query: vulnerability: Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Matching passage: CVE-2015-8352. CWE: CWE-22. CVSS: 9.800000190734863. Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Near-miss passage: CVE-2015-5471. CWE: CWE-22. CVSS: 5.300000190734863. Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via un
Matching passage: CVE-2015-4807. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache.
Near-miss passage: CVE-2015-6175. CWE: UNKNOWN. CVSS: 7.800000190734863. The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."
Query: secure coding against Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Matching passage: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Near-miss passage: CWE-657 Violation of Secure Design Principles. The product violates well-established principles for secure design.
Query: detect Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe pro in logs
Matching passage: Sigma rule: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe pro. Logsource: windows / file_event. Rule: title: LSASS Process Memory Dump Creation Via Taskmgr.EXE id: 69ca12af-119d-44ed-b50f-a47af0ebc364 status: test description: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager. author: Swachchhanda Shrawan Poudel date: 2023-10-19 references: - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1 tags: - attack.credential-access - attack.t1003.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - :\Windows\system32\taskmgr.exe - :\Windows\SysWOW64\taskmgr.exe TargetFilename|contains|all: - \AppData\Local\Temp\ - \lsass - .DMP condition: selection falsepositives: - Rare case of troubleshooting by an administrator or support that has to be investigated regardless level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/info.yml
Near-miss passage: Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Query: ATT&CK technique for Disable or Modify Linux Audit System Log
Matching passage: T1685.004 Disable or Modify Linux Audit System Log. Tactics: defense impairment. Description: Adversaries may disable or modify the Linux Audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules. Often referred to as `auditd`, this is the name of the daemon used to write events to disk and is governed by the parameters set in the `audit.conf` configuration file. Two primary ways to configure the log generation rules are through the command line `auditctl` utility and the file `/etc/audit/audit.rules`, containing a sequence of `auditctl` commands loaded at boot time.(Citation: IzyKnows auditd threat detection 2022)(Citation: Red Hat Linux Disable or Mod) With root privileges, adversaries may be able to ensure their activity is not logged through disabling the Audit system service, editing the configuration/rule files, or by hooking the Audit system library functions. Using the command line, adversaries can disable the Audit system service through killing processes associated with `auditd` daemon or use `systemctl` to stop the Audit service. Adversaries can also hook Audit system functions to disable logging or modify the rules contained in the `/etc/audit/audit.rules` or `audit.conf` files to ignore malicious activity.(Citation: ESET Ebury Feb 2014)
Near-miss passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs