alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Data from Local System
Matching passage: T1005 Data from Local System. Tactics: collection. Description: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
Near-miss passage: T1115 Clipboard Data. Tactics: collection. Description: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)
Query: rule covering Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs
Matching passage: Sigma rule: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Defaultpack.EXE id: b2309017-4235-44fe-b5af-b15363011957 status: test description: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/ - https://www.echotrail.io/insights/search/defaultpack.exe author: frack113 date: 2022-12-31 modified: 2024-04-22 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DefaultPack.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium
Query: detect Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Def in logs
Matching passage: Sigma rule: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Def. Logsource: windows / process_creation. Rule: title: Windows Defender Definition Files Removed id: 9719a8aa-401c-41af-8108-ced7ec9cd75c status: test description: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ author: frack113 date: 2021-07-07 modified: 2023-07-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MpCmdRun.exe - OriginalFileName: MpCmdRun.exe selection_cli: CommandLine|contains|all: - ' -RemoveDefinitions' - ' -All' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns-client. Rule: title: DNS Query for Anonfiles.com Domain - DNS Client id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 related: - id: 065cceea-77ec-4030-9052-fc0affea7110 type: similar status: test description: Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Query: exploit The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruptio
Matching passage: CVE-2015-3961. CWE: CWE-399. CVSS: 3.5. The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.
Near-miss passage: CVE-2015-6332. CWE: CWE-399. CVSS: 5.0. Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830.
Query: detection rule: Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for la
Matching passage: Sigma rule: Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for la. Logsource: macos / process_creation. Rule: title: Local System Accounts Discovery - MacOs id: ddf36b67-e872-4507-ab2e-46bda21b842c status: test description: 'Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md - https://ss64.com/osx/dscl.html - https://ss64.com/mac/dscacheutil.html author: Alejandro Ortuno, oscd.community date: 2020-10-08 modified: 2026-07-07 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: macos detection: selection_dscl: Image|endswith: /dscl CommandLine|contains|all: - list - /users selection_dscacheutil: Image|endswith: /dscacheutil CommandLine|contains|all: - -q - user selection_root: CommandLine|contains: '''*:0:''' selection_passwd_sudo: Image|endswith: - /cat - /awk - /grep CommandLine|contains: - /etc/passwd - /etc/sudoers selection_id: Image|endswith: /id selection_lsof: Image|endswith: /lsof CommandLine|contains: -u selection_logged_in_users: Image|endswith: - /who - /w - /users - /last selection_home_dir_listing: Image|endswith: /ls CommandLine|endswith: - /Users - /Users' - /Users" selection_loginwindow_prefs: Image|endswith: - /defaults - /plutil CommandLine|contains: com.apple.loginwindow condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-5670. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1979. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component.
Query: write Sigma for Detect when a Cloud SQL DB has been modified or deleted.
Matching passage: Sigma rule: Detect when a Cloud SQL DB has been modified or deleted.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud SQL Database Modified or Deleted id: f346bbd5-2c4e-4789-a221-72de7685090d status: test description: Detect when a Cloud SQL DB has been modified or deleted. references: - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update author: Austin Songer @austinsonger date: 2021-10-15 modified: 2022-12-25 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - cloudsql.instances.create - cloudsql.instances.delete - cloudsql.users.update - cloudsql.users.delete condition: selection falsepositives: - SQL Database being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.. Logsource: windows / image_load. Rule: title: VMGuestLib DLL Sideload id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff status: test description: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service. references: - https://decoded.avast.io/martinchlumecky/png-steganography/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains|all: - \VMware\VMware Tools\vmStatsProvider\win32 - \vmGuestLib.dll Image|endswith: \Windows\System32\wbem\WmiApSrv.exe filter: Signed: 'true' condition: selection and not filter falsepositives: - FP could occur if the legitimate version of vmGuestLib already exists on the system level: medium
Query: describe CVE-2015-7536
Matching passage: CVE-2015-7536. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
Near-miss passage: CVE-2015-2069. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.
Query: risk of Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell s
Matching passage: CVE-2015-2252. CWE: CWE-94. CVSS: 8.800000190734863. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Near-miss passage: CVE-2015-8351. CWE: CWE-94. CVSS: 9.0. PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Query: write Sigma for Detects attempts of decoding encoded Gzip archives via PowerShell.
Matching passage: Sigma rule: Detects attempts of decoding encoded Gzip archives via PowerShell.. Logsource: windows / process_creation. Rule: title: Gzip Archive Decode Via PowerShell id: 98767d61-b2e8-4d71-b661-e36783ee24c1 status: test description: Detects attempts of decoding encoded Gzip archives via PowerShell. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - GZipStream - ::Decompress condition: selection falsepositives: - Legitimate administrative scripts may use this functionality. Use "ParentImage" in combination with the script names and allowed users and applications to filter legitimate executions level: medium
Near-miss passage: Sigma rule: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases. Logsource: windows / process_creation. Rule: title: Usage Of Web Request Commands And Cmdlets id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d related: - id: 1139d2e2-84b1-4226-b445-354492eba8ba type: similar - id: f67dbfce-93bc-440d-86ad-a95ae8858c90 type: obsolete - id: cd5c8085-4070-4e22-908d-a5b3342deb74 type: obsolete - id: 6e897651-f157-4d8f-aaeb-df8151488385 type: obsolete status: test description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine references: - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/ - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell - https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger date: 2019-10-24 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '[System.Net.WebRequest]::create' - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - Resume-BitsTransfer - Start-BitsTransfer - 'wget ' - WinHttp.WinHttpRequest condition: selection falsepositives: - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer. level: medium
Query: exploit Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via 
Matching passage: CVE-2015-4494. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via a crafted app.
Near-miss passage: CVE-2015-0834. CWE: CWE-200. CVSS: 4.300000190734863. The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.
Query: secure coding against Improper Neutralization
Matching passage: CWE-707 Improper Neutralization. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Near-miss passage: CWE-116 Improper Encoding or Escaping of Output. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Query: adversary uses File and Directory Discovery
Matching passage: T1083 File and Directory Discovery. Tactics: discovery. Description: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.
Near-miss passage: T1497 Virtualization/Sandbox Evasion. Tactics: stealth, discovery. Description: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)
Query: playbook for alert: Suspicious Exfiltration to Text Storage Sites execution detected on endpoint
Matching passage: Playbook for T1567.003 Exfiltration to Text Storage Sites. 1) Validate alert telemetry against T1567.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries
Near-miss passage: Playbook for T1567 Exfiltration Over Web Service. Different response path focused on exfiltration.
Query: weakness Missing Initialization of a Variable
Matching passage: CWE-456 Missing Initialization of a Variable. The product does not initialize critical variables, which causes the execution environment to use unexpected values.
Near-miss passage: CWE-147 Improper Neutralization of Input Terminators. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
Query: Sigma rule for Detects potential exfiltration attempt via audio file using PowerShell
Matching passage: Sigma rule: Detects potential exfiltration attempt via audio file using PowerShell. Logsource: windows / ps_script. Rule: title: Potential Data Exfiltration Via Audio File id: e4f93c99-396f-47c8-bb0f-201b1fa69034 status: test description: Detects potential exfiltration attempt via audio file using PowerShell references: - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_main: ScriptBlockText|contains|all: - '[System.Math]::' - '[IO.FileMode]::' - BinaryWriter selection_header_wav: ScriptBlockText|contains|all: - '0x52' - '0x49' - '0x46' - '0x57' - '0x41' - '0x56' - '0x45' - '0xAC' condition: selection_main and 1 of selection_header_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59). Logsource: windows / process_creation. Rule: title: UAC Bypass Tools Using ComputerDefaults id: 3c05e90d-7eba-4324-9972-5d7f711a60a8 status: test description: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-31 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 Image: C:\Windows\System32\ComputerDefaults.exe filter: ParentImage|contains: - :\Windows\System32 - :\Program Files condition: selection and not filter falsepositives: - Unknown level: high