alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Outbound C2 pattern associated with Internal Defacement
Matching passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Query: detect Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon in logs
Matching passage: Sigma rule: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon. Logsource: windows / process_access. Rule: title: HackTool - SysmonEnte Execution id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e status: test description: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon references: - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html - https://github.com/codewhitesec/SysmonEnte/ - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection_sysmon: TargetImage|contains: - :\Windows\Sysmon.exe - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe GrantedAccess: '0x1400' selection_calltrace: CallTrace: Ente filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ filter_main_msdefender: SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ SourceImage|endswith: \MsMpEng.exe condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde. Logsource: windows / process_creation. Rule: title: Unmount Share Via Net.EXE id: cb7c4a03-2871-43c0-9bbb-18bbdb079896 status: test description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-08 modified: 2023-02-21 tags: - attack.stealth - attack.t1070.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - share - /delete condition: all of selection* falsepositives: - Administrators or Power users may remove their shares via cmd line level: low
Query: weakness Insecure Operation on Windows Junction / Mount Point
Matching passage: CWE-1386 Insecure Operation on Windows Junction / Mount Point. The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.
Near-miss passage: CWE-301 Reflection Attack in an Authentication Protocol. Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
Query: exploit Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecif
Matching passage: CVE-2015-1880. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8398. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.
Query: write Sigma for Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Matching passage: Sigma rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons. Logsource: windows / create_remote_thread. Rule: title: HackTool - Potential CobaltStrike Process Injection id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42 status: test description: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons references: - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/ author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community date: 2018-11-30 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: product: windows category: create_remote_thread detection: selection: StartAddress|endswith: - 0B80 - 0C7C - 0C88 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a Python process initiating a network connection. While this often relates to package installation, it can also. Logsource: windows / network_connection. Rule: title: Python Initiated Connection id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6 status: test description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python - https://pypi.org/project/scapy/ author: frack113 date: 2021-12-10 modified: 2025-03-05 tags: - attack.discovery - attack.t1046 logsource: category: network_connection product: windows definition: 'Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type' detection: selection: Initiated: 'true' Image|contains|all: - \python - .exe filter_optional_conda: ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe CommandLine|contains|all: - :\ProgramData\Anaconda3\Scripts\conda-script.py - update filter_optional_conda_jupyter_notebook: ParentImage: C:\ProgramData\Anaconda3\python.exe CommandLine|contains: C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py filter_main_local_communication: DestinationIp: 127.0.0.1 SourceIp: 127.0.0.1 filter_main_pip: CommandLine|contains|all: - pip.exe - install condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying. level: medium
Query: CVE similar to CVE-2015-4858
Matching passage: CVE-2015-4858. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913.
Near-miss passage: CVE-2015-8643. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: CVE similar to CVE-2015-4731
Matching passage: CVE-2015-4731. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Near-miss passage: CVE-2015-8746. CWE: UNKNOWN. CVSS: 7.5. fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.
Query: Encoded PowerShell / command-line abuse matching Search Open Websites/Domains
Matching passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Query: CVE similar to CVE-2015-7110
Matching passage: CVE-2015-7110. CWE: CWE-119. CVSS: 6.900000095367432. The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted disk image.
Near-miss passage: CVE-2015-0530. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in an unspecified function in nsr_render_log in EMC NetWorker before 8.0.4.3, 8.1.x before 8.1.2.6, and 8.2.x before 8.2.1.2 allows local users to gain privileges via unknown vectors.
Query: explain CWE-1332
Matching passage: CWE-1332 Improper Handling of Faults that Lead to Instruction Skips. The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
Near-miss passage: CWE-827 Improper Control of Document Type Definition. The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Query: Sigma rule for Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite)
Matching passage: Sigma rule: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite). Logsource: windows / registry_set. Rule: title: PUA - Sysinternals Tools Execution - Registry id: c7da8edc-49ae-45a2-9e61-9fd860e4e73d related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 9841b233-8df8-4ad7-9133-b0b4402a9014 type: obsolete status: test description: Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2025-10-26 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \Process Explorer - \ProcDump - \PsExec - \PsLoglist - \PsPasswd - \SDelete - \Sysinternals TargetObject|endswith: \EulaAccepted condition: selection falsepositives: - Legitimate use of SysInternals tools. Filter the legitimate paths used in your environment level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula/info.yml
Near-miss passage: Sigma rule: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Command Execution Via FTP.EXE id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e status: test description: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Ftp/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2024-04-23 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \ftp.exe selection_child_img: - Image|endswith: \ftp.exe - OriginalFileName: ftp.exe selection_child_cli: CommandLine|contains|windash: '-s:' condition: selection_parent or all of selection_child_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-3697
Matching passage: CVE-2015-3697. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
Near-miss passage: CVE-2015-5590. CWE: CWE-119. CVSS: 7.300000190734863. Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.
Query: rule covering Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
Matching passage: Sigma rule: Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks. Logsource: windows / process_creation. Rule: title: Suspicious GUP Usage id: 0a4f6091-223b-41f6-8743-f322ec84930b status: test description: Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks references: - https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html author: Florian Roth (Nextron Systems) date: 2019-02-06 modified: 2022-08-13 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \GUP.exe filter_programfiles: Image|endswith: - \Program Files\Notepad++\updater\GUP.exe - \Program Files (x86)\Notepad++\updater\GUP.exe filter_user: Image|contains: \Users\ Image|endswith: - \AppData\Local\Notepad++\updater\GUP.exe - \AppData\Roaming\Notepad++\updater\GUP.exe condition: selection and not 1 of filter_* falsepositives: - Execution of tools named GUP.exe and located in folders different than Notepad++\updater level: high
Near-miss passage: Sigma rule: Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download. Logsource: windows / network_connection. Rule: title: Uncommon Network Connection Initiated By Certutil.EXE id: 0dba975d-a193-4ed1-a067-424df57570d1 status: test description: 'Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil author: frack113, Florian Roth (Nextron Systems) date: 2022-09-02 modified: 2024-05-31 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Image|endswith: \certutil.exe Initiated: 'true' DestinationPort: - 80 - 135 - 443 - 445 condition: selection falsepositives: - Unknown level: high
Query: exploit ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to read the filteredlogs.txt file, and consequ
Matching passage: CVE-2015-6479. CWE: UNKNOWN. CVSS: 4.300000190734863. ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to read the filteredlogs.txt file, and consequently discover potentially sensitive boot-sequence information, via unspecified vectors.
Near-miss passage: CVE-2015-0459. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491.
Query: hunt for Query Registry activity
Matching passage: T1012 Query Registry. Tactics: discovery. Description: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Near-miss passage: T1007 System Service Discovery. Tactics: discovery. Description: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: linux / process_creation. Rule: title: System Network Discovery - Linux id: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: Ömer Günal and remotephone, oscd.community date: 2020-10-06 modified: 2022-09-15 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /firewall-cmd - /ufw - /iptables - /netstat - /ss - /ip - /ifconfig - /systemd-resolve - /route selection_cli: CommandLine|contains: /etc/resolv.conf condition: 1 of selection_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects the Installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: MSExchange Transport Agent Installation - Builtin id: 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6 related: - id: 83809e84-4475-4b69-bc3e-4aad8568612f type: derived status: test description: Detects the Installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-11-27 tags: - attack.persistence - attack.t1505.002 logsource: product: windows service: msexchange-management detection: selection: - Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: medium