alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects Obfuscated Powershell via use MSHTA in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Via Use MSHTA id: ac20ae82-8758-4f38-958e-b44a3140ca88 status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2022-03-08 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: Anydesk Temporary Artefact id: 0b9ad457-2554-44c1-82c2-d56a99c42377 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2024-07-20 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Roaming\AnyDesk\user.conf - \AppData\Roaming\AnyDesk\system.conf condition: selection falsepositives: - Legitimate use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells. Logsource: windows / process_creation. Rule: title: Chopper Webshell Process Pattern id: fa3c117a-bc0d-416e-a31b-0c0e80653efb status: test description: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells references: - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/ author: Florian Roth (Nextron Systems), MSTI (query) date: 2022-10-01 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_origin: - Image|endswith: \w3wp.exe - ParentImage|endswith: \w3wp.exe selection_cmdline: CommandLine|contains: - '&ipconfig&echo' - '&quser&echo' - '&whoami&echo' - '&c:&echo' - '&cd&echo' - '&dir&echo' - '&echo [E]' - '&echo [S]' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected. Logsource: azure / auditlogs. Rule: title: Added Credentials to Existing Application id: cbb67ecc-fb70-4467-9350-c910bdf7c628 status: test description: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-05-26 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.t1098.001 - attack.persistence logsource: product: azure service: auditlogs detection: selection: properties.message: - Update application – Certificates and secrets management - Update Service principal/Update Application condition: selection falsepositives: - When credentials are added/removed as part of the normal working hours/workflows level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.. Logsource: windows / process_creation. Rule: title: InfDefaultInstall.exe .inf Execution id: ce7cf472-6fcc-490a-9481-3786840b5d9b status: test description: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution - https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/ author: frack113 date: 2021-07-13 modified: 2022-10-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'InfDefaultInstall.exe ' - '.inf' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left. Logsource: linux / process_creation. Rule: title: File Deletion id: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57 status: stable description: Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md author: Ömer Günal, oscd.community date: 2020-10-07 modified: 2022-09-15 tags: - attack.stealth - attack.t1070.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /rm - /shred - /unlink condition: selection falsepositives: - Legitimate administration activities level: informational
Query: detect Detect file time attribute change to hide new or changes to existing files in logs
Matching passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files. Logsource: macos / process_creation. Rule: title: File Time Attribute Change id: 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0 status: test description: Detect file time attribute change to hide new or changes to existing files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-01-12 tags: - attack.stealth - attack.t1070.006 logsource: product: macos category: process_creation detection: selection: Image|endswith: /touch CommandLine|contains: - -t - -acmr - -d - -r condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a configuration change is made to an applications AppID URI.. Logsource: azure / auditlogs. Rule: title: Application AppID Uri Configuration Changes id: 1b45b0d1-773f-4f23-aedc-814b759563b1 status: test description: Detects when a configuration change is made to an applications AppID URI. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1552 - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: - Update Application - Update Service principal condition: selection falsepositives: - When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event. level: high
Query: Persistence mechanism resembling Domain Account
Matching passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Near-miss passage: T1136.003 Cloud Account. Tactics: persistence. Description: Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment.(Citation: Microsoft Entra ID Service Principals) In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005).(Citation: GCP Service Accounts) While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.(Citation: AWS Instance Profiles)(Citation: AWS Lambda Execution Role) Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection. Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Query: patch priority for CVE-2015-7242
Matching passage: CVE-2015-7242. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message.
Near-miss passage: CVE-2015-7796. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Query: Lateral movement indicators for Exfiltration over USB
Matching passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Query: patch priority for CVE-2015-2990
Matching passage: CVE-2015-2990. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arbitrary files via a crafted parameter.
Near-miss passage: CVE-2015-6591. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitrary files via the s parameter.
Query: detect Detects suspicious change of file privileges with chown and chmod commands in logs
Matching passage: Sigma rule: Detects suspicious change of file privileges with chown and chmod commands. Logsource: linux / process_creation. Rule: title: Setuid and Setgid id: c21c4eaa-ba2e-419a-92b2-8371703cbe21 status: test description: Detects suspicious change of file privileges with chown and chmod commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md author: Ömer Günal date: 2020-06-16 modified: 2022-10-05 tags: - attack.persistence - attack.privilege-escalation - attack.t1548.001 logsource: product: linux category: process_creation detection: selection_root: CommandLine|contains: chown root selection_perm: CommandLine|contains: - ' chmod u+s' - ' chmod g+s' condition: all of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects instances where an SSH service on an OpenCanary node has had a login attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - SSH Login Attempt id: ff7139bc-fdb1-4437-92f2-6afefe8884cb status: test description: Detects instances where an SSH service on an OpenCanary node has had a login attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.privilege-escalation - attack.initial-access - attack.lateral-movement - attack.persistence - attack.stealth - attack.t1133 - attack.t1021 - attack.t1078 logsource: category: application product: opencanary detection: selection: logtype: 4002 condition: selection falsepositives: - Unlikely level: high
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3062. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-6984. CWE: CWE-284. CVSS: 8.800000190734863. libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack.
Query: describe CVE-2015-4447
Matching passage: CVE-2015-4447. CWE: UNKNOWN. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
Near-miss passage: CVE-2015-0509. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Reporting and Analysis.
Query: Sigma rule for Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download addition
Matching passage: Sigma rule: Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download addition. Logsource: windows / process_creation. Rule: title: Suspicious CertReq Command to Download id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b status: experimental description: 'Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Certreq/ author: Christian Burkard (Nextron Systems) date: 2021-11-24 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certreq.exe - OriginalFileName: CertReq.exe selection_cli_flag_post: CommandLine|contains|windash: -Post selection_cli_flag_config: CommandLine|contains|windash: -config selection_cli_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of smbexec.py tool by detecting a specific service installation. Logsource: windows / system. Rule: title: smbexec.py Service Installation id: 52a85084-6989-40c3-8f32-091e12e13f09 status: test description: Detects the use of smbexec.py tool by detecting a specific service installation references: - https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ - https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296 - https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60 author: Omer Faruk Celik date: 2018-03-20 modified: 2023-11-09 tags: - attack.lateral-movement - attack.execution - attack.t1021.002 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_name: ServiceName: BTOBTO selection_service_image: ImagePath|contains: - '.bat & del ' - __output 2^>^&1 > condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1254
Matching passage: CVE-2015-1254. CWE: CWE-264. CVSS: 5.0. core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: patch priority for CVE-2015-10035
Matching passage: CVE-2015-10035. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
Near-miss passage: CVE-2015-10026. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in tiredtyrant flairbot. It has been declared as critical. This vulnerability affects unknown code of the file flair.py. The manipulation leads to sql injection. The patch is identified as 5e112b68c6faad1d4699d02c1ebbb7daf48ef8fb. It is recommended to apply a patch to fix this issue. VDB-217618 is the identifier assigned to this vulnerability.
Query: Persistence mechanism resembling Python
Matching passage: T1059.006 Python. Tactics: execution. Description: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Near-miss passage: T1059.001 PowerShell. Tactics: execution. Description: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)