alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to
Matching passage: Sigma rule: Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to. Logsource: windows / process_creation. Rule: title: LSASS Dump Keyword In CommandLine id: ffa6861c-4461-4f59-8a41-578c39f3f23e related: - id: a5a2d357-1ab8-4675-a967-ef9990a59391 type: derived status: test description: 'Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process. ' references: - https://github.com/Hackndo/lsassy - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/ - https://github.com/helpsystems/nanodump - https://github.com/CCob/MirrorDump author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-08-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains: - lsass.dmp - lsass.zip - lsass.rar - Andrew.dmp - Coredump.dmp - NotLSASS.zip - lsass_2 - lsassdump - lsassdmp - CommandLine|contains|all: - lsass - .dmp - CommandLine|contains|all: - SQLDmpr - .mdmp - CommandLine|contains|all: - nanodump - .dmp condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Execution id: 48bbc537-b652-4b4e-bd1d-281172df448f related: - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 type: similar status: test description: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe condition: selection falsepositives: - Unknown level: medium
Query: SOC runbook when seeing EDR alert: possible Disable or Modify Tools (T1685)
Matching passage: Playbook for T1685 Disable or Modify Tools. 1) Validate alert telemetry against T1685. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or
Near-miss passage: Playbook for T1685.005 Clear Windows Event Logs. Different response path focused on defense impairment.
Query: risk of HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-6858. CWE: CWE-200. CVSS: 3.700000047683716. HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7247. CWE: CWE-200. CVSS: 9.800000190734863. D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.
Query: Sigma rule for Detects when an an application is removed from Google Workspace.
Matching passage: Sigma rule: Detects when an an application is removed from Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Application Removed id: ee2803f0-71c8-4831-b48b-a1fc57601ee4 status: test description: Detects when an an application is removed from Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST author: Austin Songer date: 2021-08-26 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - REMOVE_APPLICATION - REMOVE_APPLICATION_FROM_WHITELIST condition: selection falsepositives: - Application being removed may be performed by a System Administrator. level: medium
Near-miss passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: Suspicious AgentExecutor PowerShell Execution id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab related: - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_pwsh: CommandLine|contains: - C:\Windows\System32\WindowsPowerShell\v1.0\ - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: detect Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. in logs
Matching passage: Sigma rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.. Logsource: windows / openssh. Rule: title: OpenSSH Server Listening On Socket id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 status: test description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. references: - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH - https://winaero.com/enable-openssh-server-windows-10/ - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: mdecrevoisier date: 2022-10-25 tags: - attack.lateral-movement - attack.t1021.004 logsource: product: windows service: openssh detection: selection: EventID: 4 process: sshd payload|startswith: 'Server listening on ' condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects DCShadow via create new SPN. Logsource: windows / security. Rule: title: Possible DC Shadow Attack id: 32e19d25-4aed-4860-a55a-be99cb0bf7ed related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: derived status: test description: Detects DCShadow via create new SPN references: - https://twitter.com/gentilkiwi/status/1003236624925413376 - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 - https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48 author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah date: 2019-10-25 modified: 2022-10-17 tags: - attack.credential-access - attack.defense-impairment - attack.t1207 logsource: product: windows service: security definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule) detection: selection1: EventID: 4742 ServicePrincipalNames|contains: GC/ selection2: EventID: 5136 AttributeLDAPDisplayName: servicePrincipalName AttributeValue|startswith: GC/ condition: 1 of selection* falsepositives: - Valid on domain controllers; exclude known DCs level: medium
Query: rule covering Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ
Matching passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / image_load. Rule: title: Wmiprvse Wbemcomn DLL Hijack id: 7707a579-e0d8-4886-a853-ce47e4575aaa status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-10-09 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: image_load detection: selection: Image|endswith: \wmiprvse.exe ImageLoaded|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used. Logsource: windows / ps_script. Rule: title: Code Executed Via Office Add-in XLL File id: 36fbec91-fa1b-4d5d-8df1-8d8edcb632ad status: test description: 'Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137.006/T1137.006.md author: frack113 date: 2021-12-28 tags: - attack.persistence - attack.t1137.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'new-object ' - '-ComObject ' - .application - .RegisterXLL condition: selection falsepositives: - Unknown level: high
Query: Outbound C2 pattern associated with Obfuscated Files or Information
Matching passage: T1027 Obfuscated Files or Information. Tactics: stealth. Description: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)
Near-miss passage: T1027.004 Compile After Delivery. Tactics: stealth. Description: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Query: detect Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure in logs
Matching passage: Sigma rule: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure. Logsource: windows / process_creation. Rule: title: PUA - DefenderCheck Execution id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7 status: test description: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion. references: - https://github.com/matterpreter/DefenderCheck author: Florian Roth (Nextron Systems) date: 2022-08-30 modified: 2023-02-04 tags: - attack.stealth - attack.t1027.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \DefenderCheck.exe - Description: DefenderCheck condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of the hacktool Rubeus using specific command line flags. Logsource: windows / ps_script. Rule: title: HackTool - Rubeus Execution - ScriptBlock id: 3245cd30-e015-40ff-a31d-5cadd5f377ec related: - id: 7ec2c172-dceb-4c10-92c9-87c1881b7e18 type: similar status: test description: Detects the execution of the hacktool Rubeus using specific command line flags references: - https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html - https://github.com/GhostPack/Rubeus author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-04-27 tags: - attack.credential-access - attack.t1003 - attack.t1558.003 - attack.lateral-movement - attack.t1550.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'asreproast ' - 'dump /service:krbtgt ' - dump /luid:0x - 'kerberoast ' - 'createnetonly /program:' - 'ptt /ticket:' - '/impersonateuser:' - 'renew /ticket:' - 'asktgt /user:' - 'harvest /interval:' - 's4u /user:' - 's4u /ticket:' - 'hash /password:' - 'golden /aes256:' - 'silver /user:' condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-0887
Matching passage: CVE-2015-0887. CWE: CWE-399. CVSS: 7.099999904632568. npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30, SEIL/X1 routers 3.50 through 4.70, SEIL/X2 routers 3.50 through 4.70, and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
Near-miss passage: CVE-2015-8231. CWE: CWE-399. CVSS: 7.5. Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 allow remote attackers with established sessions to cause a denial of service (device restart) via unspecified packets.
Query: rule covering Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution
Matching passage: Sigma rule: Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Home Page id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 related: - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 type: similar status: test description: 'Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70 - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-09 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Software\Microsoft\Office\ - \Outlook\WebView\ TargetObject|endswith: \URL condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.. Logsource: windows / process_creation. Rule: title: C# IL Code Compilation Via Ilasm.EXE id: 850d55f9-6eeb-4492-ad69-a72338f65ba4 status: test description: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL. references: - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/ - https://www.echotrail.io/insights/search/ilasm.exe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-07 modified: 2022-05-16 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \ilasm.exe - OriginalFileName: ilasm.exe selection_cli: CommandLine|contains: - ' /dll' - ' /exe' condition: all of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-0259
Matching passage: CVE-2015-0259. CWE: CWE-345. CVSS: 5.099999904632568. OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
Near-miss passage: CVE-2015-8254. CWE: CWE-345. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices does not use integrity protection, which makes it easier for man-in-the-middle attackers to (1) initiate a false alarm or (2) deactivate an alarm by modifying the client-server data stream.
Query: CWE for Improper Protection against Electromagnetic Fault Injection (EM-FI)
Matching passage: CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI). The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed.
Near-miss passage: CWE-1389 Incorrect Parsing of Numbers with Different Radices. The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).
Query: patch priority for CVE-2015-1694
Matching passage: CVE-2015-1694. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710.
Near-miss passage: CVE-2015-8072. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Query: vulnerability: actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of ser
Matching passage: CVE-2015-7581. CWE: CWE-399. CVSS: 7.5. actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Near-miss passage: CVE-2015-5470. CWE: CWE-399. CVSS: 7.800000190734863. The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
Query: CVE similar to CVE-2015-3378
Matching passage: CVE-2015-3378. CWE: UNKNOWN. CVSS: 4.900000095367432. Open redirect vulnerability in the Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal, when the Views UI submodule is enabled, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to the break lock page for edited views.
Near-miss passage: CVE-2015-0425. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Siebel Core - Unix/Windows.