alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: risk of Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect integrity via vector
Matching passage: CVE-2015-4926. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect integrity via vectors related to UIX.
Near-miss passage: CVE-2015-1321. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which. Logsource: linux / process_creation. Rule: title: Suspicious Invocation of Shell via Rsync id: 297241f3-8108-4b3a-8c15-2dda9f844594 status: experimental description: 'Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation. ' references: - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/ - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10 author: Florian Roth date: 2025-01-18 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /rsync - /rsyncd Image|endswith: - /ash - /bash - /csh - /dash - /ksh - /sh - /tcsh - /zsh filter_main_expected: CommandLine|contains: ' -e ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that. Logsource: windows / security. Rule: title: Account Tampering - Suspicious Failed Logon Reasons id: 9eb99343-d336-4020-a3cd-67f3819e68ee status: test description: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 - https://twitter.com/SBousseaden/status/1101431884540710913 author: Florian Roth (Nextron Systems) date: 2017-02-19 modified: 2025-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078 logsource: product: windows service: security detection: selection_eid: EventID: - 4625 - 4776 selection_status: - Status: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' - SubStatus: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' filter: SubjectUserSid: S-1-0-0 condition: all of selection_* and not filter falsepositives: - User using a disabled account level: medium
Query: risk of Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script or HTML via a blocked site link.
Matching passage: CVE-2015-8936. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script or HTML via a blocked site link.
Near-miss passage: CVE-2015-5151. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
Query: patch priority for CVE-2015-2871
Matching passage: CVE-2015-2871. CWE: CWE-264. CVSS: 7.5. Chiyu BF-660C fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify communication configuration settings via a request to net.htm, a different vulnerability than CVE-2015-5618.
Near-miss passage: CVE-2015-3273. CWE: CWE-264. CVSS: 4.300000190734863. mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
Query: describe CVE-2015-2770
Matching passage: CVE-2015-2770. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-4255. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP Gateway devices with software 2.0(3.34) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90734.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar. Logsource: windows / ps_script. Rule: title: Enable Windows Remote Management id: 991a9744-f2f0-44f2-bd33-9092eba17dc3 status: test description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2 author: frack113 date: 2022-01-07 tags: - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Enable-PSRemoting ' condition: selection_cmdlet falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Detects suspicious renamed SysInternals DebugView execution. Logsource: windows / process_creation. Rule: title: Renamed SysInternals DebugView Execution id: cd764533-2e07-40d6-a718-cfeec7f2da7f status: test description: Detects suspicious renamed SysInternals DebugView execution references: - https://www.epicturla.com/blog/sysinturla author: Florian Roth (Nextron Systems) date: 2020-05-28 modified: 2023-02-14 tags: - attack.resource-development - attack.t1588.002 logsource: category: process_creation product: windows detection: selection: Product: Sysinternals DebugView filter: OriginalFileName: Dbgview.exe Image|endswith: \Dbgview.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-3904
Matching passage: CVE-2015-3904. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) pin, (2) start_day, (3) start_month, (4) start_year, (5) end_day, (6) end_month, (7) end_year, (8) lang, (9) adults, or (10) children parameter.
Near-miss passage: CVE-2015-7565. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
Query: describe CVE-2015-4791
Matching passage: CVE-2015-4791. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that m. Logsource: windows / ps_script. Rule: title: Powershell Timestomp id: c6438007-e081-42ce-9483-b067fbef33c3 status: test description: 'Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md - https://www.offensive-security.com/metasploit-unleashed/timestomp/ author: frack113 date: 2021-08-03 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ioc: ScriptBlockText|contains: - .CreationTime = - .LastWriteTime = - .LastAccessTime = - '[IO.File]::SetCreationTime' - '[IO.File]::SetLastAccessTime' - '[IO.File]::SetLastWriteTime' condition: selection_ioc falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Detect modification of TreatAs key to enable "rundll32.exe -sta" command. Logsource: windows / registry_set. Rule: title: COM Hijacking via TreatAs id: dc5c24af-6995-49b2-86eb-a9ff62199e82 status: test description: Detect modification of TreatAs key to enable "rundll32.exe -sta" command references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md - https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s author: frack113 date: 2022-08-28 modified: 2025-07-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: TreatAs\(Default) filter_office: Image|startswith: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_office2: Image: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe filter_svchost: Image: C:\Windows\system32\svchost.exe filter_misexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe condition: selection and not 1 of filter_* falsepositives: - Legitimate use level: medium
Query: detect Detects user data export activity. in logs
Matching passage: Sigma rule: Detects user data export activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket User Details Export Attempt Detected id: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 status: test description: Detects user data export activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.reconnaissance - attack.discovery - attack.t1213 - attack.t1082 - attack.t1591.004 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Users and groups auditType.action: - User permissions export failed - User permissions export started - User permissions exported condition: selection falsepositives: - Legitimate user activity. level: medium
Near-miss passage: Sigma rule: Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the. Logsource: linux / process_creation. Rule: title: Potential PHP Reverse Shell id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e status: test description: 'Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection. ' references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: /php CommandLine|contains|all: - ' -r ' - fsockopen CommandLine|contains: - ash - bash - bsh - csh - ksh - pdksh - sh - tcsh - zsh condition: selection falsepositives: - Unknown level: high
Query: ATT&CK technique for Shared Webroot
Matching passage: T1051 Shared Webroot. Tactics: lateral movement. Description: **This technique has been deprecated and should no longer be used.** Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured. This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)
Near-miss passage: T1210 Exploitation of Remote Services. Tactics: lateral movement. Description: Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system. An adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Discovery](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources. There are several well-known vulnerabilities that exist in common services such as SMB(Citation: CIS Multiple SMB Vulnerabilities) and RDP(Citation: NVD CVE-2017-0176) as well as applications that may be used within internal networks such as MySQL(Citation: NVD CVE-2016-6662) and web server services.(Citation: NVD CVE-2014-7169)(Citation: Ars Technica VMWare Code Execution Vulnerability 2021) Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.(Citation: Broadcom VMSA-2024-0019) Depending on the permissions level of the vulnerable remote service an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) as a result of lateral movement exploitation as well.
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects the addition of a new network route to a route table in AWS.. Logsource: aws / cloudtrail. Rule: title: New Network Route Added id: c803b2ce-c4a2-4836-beae-b112010390b1 status: test description: 'Detects the addition of a new network route to a route table in AWS. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateRoute condition: selection falsepositives: - New VPC Creation requiring setup of a new route table - New subnets added requiring routing setup level: medium
Near-miss passage: Sigma rule: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get i. Logsource: windows / registry_set. Rule: title: Add Debugger Entry To Hangs Key For Persistence id: 833ef470-fa01-4631-a79b-6f291c9ac498 status: test description: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes references: - https://persistence-info.github.io/Data/wer_debugger.html - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\Debugger condition: selection falsepositives: - This value is not set by default but could be rarly used by administrators level: high
Query: Sigma rule for Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro
Matching passage: Sigma rule: Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro. Logsource: linux / network_connection. Rule: title: Communication To LocaltoNet Tunneling Service Initiated - Linux id: c4568f5d-131f-4e78-83d4-45b2da0ec4f1 status: test description: 'Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls. ' references: - https://localtonet.com/documents/supported-tunnels - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications author: Andreas Braathen (mnemonic.io) date: 2024-06-17 tags: - attack.command-and-control - attack.t1572 - attack.t1090 - attack.t1102 logsource: category: network_connection product: linux detection: selection: DestinationHostname|endswith: - .localto.net - .localtonet.com Initiated: 'true' condition: selection falsepositives: - Legitimate use of the LocaltoNet service. level: high
Near-miss passage: Sigma rule: Detects when Okta FastPass prevents a known phishing site.. Logsource: okta / okta. Rule: title: Okta FastPass Phishing Detection id: ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e status: test description: Detects when Okta FastPass prevents a known phishing site. references: - https://sec.okta.com/fastpassphishingdetection - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2023-05-07 modified: 2026-04-27 tags: - attack.initial-access - attack.t1566 logsource: product: okta service: okta detection: selection: outcome.reason: FastPass declined phishing attempt outcome.result: FAILURE eventType: user.authentication.auth_via_mfa condition: selection falsepositives: - Unlikely level: high