alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects PowerShell scripts to set the ACL to a file in the Windows folder. Logsource: windows / process_creation. Rule: title: PowerShell Set-Acl On Windows Folder id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell scripts to set the ACL to a file in the Windows folder references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cmdlet: CommandLine|contains|all: - 'Set-Acl ' - '-AclObject ' selection_paths: CommandLine|contains: - -Path "C:\Windows - -Path 'C:\Windows - -Path %windir% - -Path $env:windir selection_permissions: CommandLine|contains: - FullControl - Allow condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Query: CVE similar to CVE-2015-2348
Matching passage: CVE-2015-2348. CWE: CWE-264. CVSS: 5.0. The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Near-miss passage: CVE-2015-8570. CWE: CWE-264. CVSS: 7.400000095367432. The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user passwords via a crafted request.
Query: patch priority for CVE-2015-0500
Matching passage: CVE-2015-0500. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors.
Near-miss passage: CVE-2015-5184. CWE: UNKNOWN. CVSS: 7.5. Console: CORS headers set to allow all in Red Hat AMQ.
Query: explain T1027.013 Encrypted/Encoded File
Matching passage: T1027.013 Encrypted/Encoded File. Tactics: stealth. Description: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use. This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64. The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection. For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a [Phishing](https://attack.mitre.org/techniques/T1566) payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: SFX - Encrypted/Encoded File) Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until [Command and Scripting Interpreter](https://attack.mitre.org/techn
Near-miss passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Query: Lateral movement indicators for Email Addresses
Matching passage: T1589.002 Email Addresses. Tactics: reconnaissance. Description: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Near-miss passage: T1589.003 Employee Names. Tactics: reconnaissance. Description: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Query: describe CVE-2015-4934
Matching passage: CVE-2015-4934. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4933, and CVE-2015-4935.
Near-miss passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Query: describe CVE-2015-5522
Matching passage: CVE-2015-5522. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.
Near-miss passage: CVE-2015-4143. CWE: CWE-119. CVSS: 5.0. The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.
Query: risk of Unspecified vulnerability in the XDK and XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect availab
Matching passage: CVE-2015-0479. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the XDK and XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect availability via unknown vectors.
Near-miss passage: CVE-2015-0921. CWE: UNKNOWN. CVSS: 4.0. XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
Query: write Sigma for Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Matching passage: Sigma rule: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.. Logsource: windows / process_creation. Rule: title: Potential DLL File Download Via PowerShell Invoke-WebRequest id: 0f0450f3-8b47-441e-a31b-15a91dc243e2 status: test description: Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Florian Roth (Nextron Systems), Hieu Tran date: 2023-03-13 modified: 2025-07-18 tags: - attack.command-and-control - attack.execution - attack.t1059.001 - attack.t1105 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Invoke-RestMethod ' - 'Invoke-WebRequest ' - 'IRM ' - 'IWR ' CommandLine|contains|all: - http - OutFile - .dll condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects important or interesting Windows services that got terminated unexpectedly.. Logsource: windows / system. Rule: title: Important Windows Service Terminated Unexpectedly id: 56abae0c-6212-4b97-adc0-0b559bb950c3 status: test description: Detects important or interesting Windows services that got terminated unexpectedly. references: - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7034 selection_name: - param1|contains: Message Queuing - Binary|contains: - 4d0053004d005100 - 6d0073006d007100 condition: all of selection_* falsepositives: - Rare false positives could occur since service termination could happen due to multiple reasons level: high
Query: risk of Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3121. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3120, CVE-2015-3122, and CVE-2015-4433.
Near-miss passage: CVE-2015-5555. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5558, and CVE-2015-5562.
Query: write Sigma for Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible fo
Matching passage: Sigma rule: Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible fo. Logsource: windows / file_event. Rule: title: Potentially Suspicious File Creation by OpenEDR's ITSMService id: 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d status: experimental description: 'Detects the creation of potentially suspicious files by OpenEDR''s ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment. ' author: '@kostastsale' date: 2026-02-19 references: - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c tags: - attack.command-and-control - attack.t1105 - attack.lateral-movement - attack.t1570 - attack.t1219 logsource: product: windows category: file_event detection: selection_process: Image|endswith: \COMODO\Endpoint Manager\ITSMService.exe selection_suspicious_extensions: TargetFilename|endswith: - .7z - .bat - .cmd - .com - .dll - .exe - .hta - .js - .pif - .ps1 - .rar - .scr - .vbe - .vbs - .zip condition: all of selection_* falsepositives: - Legitimate OpenEDR file management operations - Authorized remote file uploads by IT administrators - Software deployment through OpenEDR console level: medium
Near-miss passage: Sigma rule: Detects Access to LSASS Process. Logsource: windows / windefend. Rule: title: LSASS Access Detected via Attack Surface Reduction id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98 status: test description: Detects Access to LSASS Process references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction author: Markus Neis date: 2018-08-26 modified: 2022-08-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)' detection: selection: EventID: 1121 Path|endswith: \lsass.exe filter_thor: ProcessName|startswith: C:\Windows\Temp\asgard2-agent\ ProcessName|endswith: - \thor64.exe - \thor.exe filter_exact: ProcessName: - C:\Windows\System32\atiesrxx.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\msiexec.exe - C:\Windows\System32\nvwmi64.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\Taskmgr.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\msiexec.exe filter_begins: ProcessName|startswith: - C:\Windows\System32\DriverStore\ - C:\WINDOWS\Installer\ - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_* falsepositives: - Google Chrome GoogleUpdate.exe - Some Taskmgr.exe related activity level: high
Query: write Sigma for Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.
Matching passage: Sigma rule: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.. Logsource: windows / process_creation. Rule: title: CobaltStrike Load by Rundll32 id: ae9c6a7c-9521-42a6-915e-5aaa8689d529 status: test description: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line. references: - https://www.cobaltstrike.com/help-windows-executable - https://redcanary.com/threat-detection-report/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ author: Wojciech Lesicki date: 2021-06-01 modified: 2022-09-16 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_rundll: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: - rundll32.exe - 'rundll32 ' selection_params: CommandLine|contains: .dll CommandLine|endswith: - ' StartW' - ',StartW' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies when a Azure Kubernetes network policy is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Network Policy Change id: 08d6ac24-c927-4469-b3b7-2e422d6e3c43 status: test description: Identifies when a Azure Kubernetes network policy is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/DELETE condition: selection falsepositives: - Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: describe CVE-2015-6299
Matching passage: CVE-2015-6299. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
Near-miss passage: CVE-2015-1560. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Query: write Sigma for Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the inter
Matching passage: Sigma rule: Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the inter. Logsource: aws / cloudtrail. Rule: title: New AWS Lambda Function URL Configuration Created id: ec541962-c05a-4420-b9ea-84de072d18f4 status: experimental description: 'Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function''s IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function. ' references: - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: lambda.amazonaws.com eventName: CreateFunctionUrlConfig condition: selection falsepositives: - Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63). Logsource: windows / process_creation. Rule: title: UAC Bypass Using DismHost id: 853e74f9-9392-4935-ad3b-2e8c040dae86 status: test description: Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - C:\Users\ - \AppData\Local\Temp\ - \DismHost.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high