alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases
Matching passage: Sigma rule: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases. Logsource: windows / process_creation. Rule: title: Usage Of Web Request Commands And Cmdlets id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d related: - id: 1139d2e2-84b1-4226-b445-354492eba8ba type: similar - id: f67dbfce-93bc-440d-86ad-a95ae8858c90 type: obsolete - id: cd5c8085-4070-4e22-908d-a5b3342deb74 type: obsolete - id: 6e897651-f157-4d8f-aaeb-df8151488385 type: obsolete status: test description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine references: - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/ - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell - https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger date: 2019-10-24 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '[System.Net.WebRequest]::create' - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - Resume-BitsTransfer - Start-BitsTransfer - 'wget ' - WinHttp.WinHttpRequest condition: selection falsepositives: - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer. level: medium
Near-miss passage: Sigma rule: Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused. Logsource: windows / process_creation. Rule: title: Forfiles Command Execution id: 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b related: - id: a85cf4e3-56ee-4e79-adeb-789f8fb209a8 type: obsolete - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02 type: obsolete status: test description: 'Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Forfiles/ - https://pentestlab.blog/2020/07/06/indirect-command-execution/ author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2022-06-14 modified: 2024-03-05 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \forfiles.exe - OriginalFileName: forfiles.exe selection_cli: CommandLine|contains|windash: ' -c ' condition: all of selection_* falsepositives: - Legitimate use via a batch script or by an administrator. level: medium
Query: rule covering Detects relevant commands often related to malware or hacking activity
Matching passage: Sigma rule: Detects relevant commands often related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Suspicious Commands Linux id: 1543ae20-cbdf-4ec1-8d12-7664d667a825 status: test description: Detects relevant commands often related to malware or hacking activity references: - Internal Research - mostly derived from exploit code including code in MSF author: Florian Roth (Nextron Systems) date: 2017-12-12 modified: 2022-10-05 tags: - attack.execution - attack.t1059.004 logsource: product: linux service: auditd detection: cmd1: type: EXECVE a0: chmod a1: 777 cmd2: type: EXECVE a0: chmod a1: u+s cmd3: type: EXECVE a0: cp a1: /bin/ksh cmd4: type: EXECVE a0: cp a1: /bin/sh condition: 1 of cmd* falsepositives: - Admin activity level: medium
Near-miss passage: Sigma rule: Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode. Logsource: macos / process_creation. Rule: title: Network Sniffing - MacOs id: adc9bcc4-c39c-4f6b-a711-1884017bf043 status: test description: 'Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2022-11-26 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: macos detection: selection: Image|endswith: - /tcpdump - /tshark condition: selection falsepositives: - Legitimate administration activities level: informational
Query: CVE similar to CVE-2015-8436
Matching passage: CVE-2015-8436. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the PrintJob object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted addPage arguments, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-2342. CWE: UNKNOWN. CVSS: 10.0. The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
Query: vulnerability: Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1,
Matching passage: CVE-2015-2513. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2514 and CVE-2015-2530.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Query: patch priority for CVE-2015-4296
Matching passage: CVE-2015-4296. CWE: CWE-399. CVSS: 5.0. Nexus Data Broker (NDB) on Cisco Nexus 3000 devices with software 6.0(2)A6(1) allows remote attackers to cause a denial of service (Java process restart) via crafted connections to the Java application, aka Bug ID CSCut87006.
Near-miss passage: CVE-2015-6646. CWE: CWE-399. CVSS: 6.199999809265137. The System V IPC implementation in the kernel in Android before 6.0 2016-01-01 allows attackers to cause a denial of service (global kernel resource consumption) by leveraging improper interaction between IPC resource allocation and the memory manager, aka internal bug 22300191, a different vulnerability than CVE-2015-7613.
Query: patch priority for CVE-2015-3118
Matching passage: CVE-2015-3118. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-8634. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: common weakness: Always-Incorrect Control Flow Implementation
Matching passage: CWE-670 Always-Incorrect Control Flow Implementation. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Near-miss passage: CWE-522 Insufficiently Protected Credentials. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Query: risk of The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the
Matching passage: CVE-2015-7359. CWE: CWE-264. CVSS: 7.800000190734863. The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
Near-miss passage: CVE-2015-1292. CWE: CWE-264. CVSS: 5.0. The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Query: vulnerability: The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of ser
Matching passage: CVE-2015-4486. CWE: CWE-119. CVSS: 10.0. The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
Near-miss passage: CVE-2015-9204. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, if cchFriendlyName is greater than TZ_PR_MAX_NAME_LEN in function playready_leavedomain_generate_challenge(), a buffer overread occurs.
Query: risk of Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-6150. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6154.
Near-miss passage: CVE-2015-3741. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: write Sigma for Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.
Matching passage: Sigma rule: Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.. Logsource: windows / registry_set. Rule: title: Change Winevt Channel Access Permission Via Registry id: 7d9263bd-dc47-4a58-bc92-5474abab390c status: test description: Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel. references: - https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/ - https://learn.microsoft.com/en-us/windows/win32/api/winevt/ - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: frack113 date: 2022-09-17 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \ChannelAccess Details|contains: - (A;;0x1;;;LA) - (A;;0x1;;;SY) - (A;;0x5;;;BA) filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machi. Logsource: windows / security. Rule: title: DCERPC SMB Spoolss Named Pipe id: 214e8f95-100a-4e04-bb31-ef6cba8ce07e status: test description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 - https://dirkjanm.io/a-different-way-of-abusing-zerologon/ - https://twitter.com/_dirkjan/status/1309214379003588608 author: OTR (Open Threat Research) date: 2018-11-28 modified: 2022-08-11 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName: spoolss condition: selection falsepositives: - Domain Controllers acting as printer servers too? :) level: medium
Query: risk of SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug
Matching passage: CVE-2015-6433. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCut66767.
Near-miss passage: CVE-2015-5599. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects a network connection initiated by "Regsvr32.exe". Logsource: windows / network_connection. Rule: title: Network Connection Initiated By Regsvr32.EXE id: c7e91a02-d771-4a6d-a700-42587e0b1095 status: test description: Detects a network connection initiated by "Regsvr32.exe" references: - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/ - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/ author: Dmitriy Lifanov, oscd.community date: 2019-10-25 modified: 2023-09-18 tags: - attack.execution - attack.stealth - attack.t1559.001 - attack.t1218.010 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \regsvr32.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed). Logsource: windows / file_event. Rule: title: AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File id: d353dac0-1b41-46c2-820c-d7d2561fc6ed related: - id: 074e0ded-6ced-4ebd-8b4d-53f55908119d type: derived status: test description: Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed) references: - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404 author: Julia Fomina, oscd.community date: 2020-10-06 modified: 2022-11-28 tags: - attack.stealth - attack.t1216 logsource: product: windows category: file_event detection: system_files: TargetFilename|endswith: - WsmPty.xsl - WsmTxt.xsl in_system_folder: TargetFilename|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: system_files and not in_system_folder falsepositives: - Unlikely level: medium
Query: exploit The code-signing implementation in Apple OS X before 10.10.4 does not properly consider libraries that are external to an application bundle, which allows attackers to bypass inten
Matching passage: CVE-2015-3715. CWE: CWE-254. CVSS: 6.800000190734863. The code-signing implementation in Apple OS X before 10.10.4 does not properly consider libraries that are external to an application bundle, which allows attackers to bypass intended launch restrictions via a crafted library.
Near-miss passage: CVE-2015-1297. CWE: CWE-254. CVSS: 7.5. The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.
Query: patch priority for CVE-2015-1431
Matching passage: CVE-2015-1431. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
Near-miss passage: CVE-2015-0139. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: threat report mentioning Vulnerabilities
Matching passage: T1588.006 Vulnerabilities. Tactics: resource development. Description: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).
Near-miss passage: T1588.007 Artificial Intelligence. Tactics: resource development. Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
Query: alert when Detects Bitsadmin connections to IP addresses instead of FQDN names
Matching passage: Sigma rule: Detects Bitsadmin connections to IP addresses instead of FQDN names. Logsource: proxy. Rule: title: Bitsadmin to Uncommon IP Server Address id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 status: test description: Detects Bitsadmin connections to IP addresses instead of FQDN names references: - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2022-08-24 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ cs-host|endswith: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and es. Logsource: aws / cloudtrail. Rule: title: AWS STS GetSessionToken Misuse id: b45ab1d2-712f-4f01-a751-df3826969807 status: test description: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges. references: - https://github.com/elastic/detection-rules/pull/1213 - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: sts.amazonaws.com eventName: GetSessionToken userIdentity.type: IAMUser condition: selection falsepositives: - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low