alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects suspicious file type dropped by an Exchange component in IIS
Matching passage: Sigma rule: Detects suspicious file type dropped by an Exchange component in IIS. Logsource: windows / file_event. Rule: title: Suspicious File Drop by Exchange id: 6b269392-9eba-40b5-acb6-55c882b20ba6 related: - id: bd1212e5-78da-431e-95fa-c58e3237a8e6 type: similar status: test description: Detects suspicious file type dropped by an Exchange component in IIS references: - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/ - https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html - https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html author: Florian Roth (Nextron Systems) date: 2022-10-04 tags: - attack.persistence - attack.t1190 - attack.initial-access - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: \w3wp.exe CommandLine|contains: MSExchange selection_types: TargetFilename|endswith: - .aspx - .asp - .ashx - .ps1 - .bat - .exe - .dll - .vbs condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov. Logsource: windows / process_creation. Rule: title: Service Registry Key Deleted Via Reg.EXE id: 05b2aa93-1210-42c8-8d9a-2fcc13b284f5 status: test description: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services references: - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: reg.exe - OriginalFileName: reg.exe selection_delete: CommandLine|contains: ' delete ' selection_key: CommandLine|contains: \SYSTEM\CurrentControlSet\services\ condition: all of selection_* falsepositives: - Unlikely level: high
Query: Sigma YAML for okta / okta
Matching passage: Sigma rule: Detects when an Network Zone is Deactivated or Deleted.. Logsource: okta / okta. Rule: title: Okta Network Zone Deactivated or Deleted id: 9f308120-69ed-4506-abde-ac6da81f4310 status: test description: Detects when an Network Zone is Deactivated or Deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - zone.deactivate - zone.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat. Logsource: windows / process_creation. Rule: title: Deleted Data Overwritten Via Cipher.EXE id: 4b046706-5789-4673-b111-66f25fe99534 status: test description: 'Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive author: frack113 date: 2021-12-26 modified: 2023-02-21 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: CIPHER.EXE - Image|endswith: \cipher.exe selection_cli: CommandLine|contains: ' /w:' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml simulation: - type: atomic-red-team name: Overwrite deleted data on C drive technique: T1485 atomic_guid: 321fd25e-0007-417f-adec-33232252be19
Query: explain T1098.006 Additional Container Cluster Roles
Matching passage: T1098.006 Additional Container Cluster Roles. Tactics: persistence, privilege escalation. Description: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC) This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Near-miss passage: T1098.007 Additional Local or Domain Groups. Tactics: persistence, privilege escalation. Description: An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.(Citation: Microsoft Net Localgroup)(Citation: Microsoft Net Group) On Linux, adversaries may use the `usermod` command for the same purpose.(Citation: Linux Usermod) For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) to log into the endpoints in the future.(Citation: Microsoft RDP Logons) Adversaries may also add accounts to VPN user groups to gain future persistence on the network.(Citation: Cyber Security News) On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage [Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) for elevated privileges. In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.(Citation: RootDSE AD Detection 2022)
Query: detect Detects the creation of a macro file for Outlook. in logs
Matching passage: Sigma rule: Detects the creation of a macro file for Outlook.. Logsource: windows / file_event. Rule: title: New Outlook Macro Created id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 related: - id: 117d3d3a-755c-4a61-b23e-9171146d094c type: derived status: test description: Detects the creation of a macro file for Outlook. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ author: '@ScoubiMtl' date: 2021-04-05 modified: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: file_event product: windows detection: selection: Image|endswith: \outlook.exe TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM condition: selection falsepositives: - User genuinely creates a VB Macro for their email level: medium
Near-miss passage: Sigma rule: Detect filter driver unloading activity via fltmc.exe. Logsource: windows / process_creation. Rule: title: Filter Driver Unloaded Via Fltmc.EXE id: 4931188c-178e-4ee7-a348-39e8a7a56821 related: - id: 4d7cda18-1b12-4e52-b45c-d28653210df8 type: derived status: test description: Detect filter driver unloading activity via fltmc.exe references: - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon - https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-13 modified: 2025-10-07 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - attack.t1685.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \fltMC.exe - OriginalFileName: fltMC.exe selection_cli: CommandLine|contains: unload filter_optional_avira: ParentImage|contains: - \AppData\Local\Temp\ - :\Windows\Temp\ ParentImage|endswith: \endpoint-protection-installer-x64.tmp CommandLine|endswith: - unload rtp_filesystem_filter - unload rtp_filter filter_optional_manageengine: ParentImage: C:\Program Files (x86)\ManageEngine\uems_agent\bin\dcfaservice64.exe CommandLine|endswith: unload DFMFilter condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: exploit Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
Matching passage: CVE-2015-1795. CWE: CWE-264. CVSS: 7.800000190734863. Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
Near-miss passage: CVE-2015-7496. CWE: CWE-264. CVSS: 7.199999809265137. GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Query: rule covering Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.
Matching passage: Sigma rule: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.. Logsource: windows / process_creation. Rule: title: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3 status: test description: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/ - https://twitter.com/_felamos/status/1204705548668555264 - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/ author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2025-10-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet.exe - OriginalFileName: .NET Host selection_cli: CommandLine|endswith: - .csproj - .csproj" - .dll - .dll" - .csproj' - .dll' filter_optional_notepadplus_plus: ParentImage: - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\Notepad++\notepad++.exe CommandLine|contains|all: - C:\ProgramData\CSScriptNpp\ - '-cscs_path:' - \cs-script\cscs.dll condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrator usage level: medium
Near-miss passage: Sigma rule: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg". Logsource: windows / file_event. Rule: title: Suspicious File Created Via OneNote Application id: fcc6d700-68d9-4241-9a1a-06874d621b06 status: test description: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/MaD_c4t/status/1623414582382567424 - https://labs.withsecure.com/publications/detecting-onenote-abuse - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/ - https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-09 modified: 2023-02-27 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \onenote.exe - \onenotem.exe - \onenoteim.exe TargetFilename|contains: \AppData\Local\Temp\OneNote\ TargetFilename|endswith: - .bat - .chm - .cmd - .dll - .exe - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf condition: selection falsepositives: - False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote. - Occasional FPs might occur if OneNote is used internally to share different embedded documents level: high
Query: CVE similar to CVE-2015-6109
Matching passage: CVE-2015-6109. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism, and consequently discover a driver base address, via a crafted application, aka "Windows Kernel Memory Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-3293. CWE: CWE-200. CVSS: 4.0. FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
Query: risk of The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based
Matching passage: CVE-2015-8242. CWE: CWE-119. CVSS: 5.800000190734863. The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Near-miss passage: CVE-2015-7180. CWE: CWE-119. CVSS: 7.5. The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Query: vulnerability: Spotlight in Apple OS X before 10.10.4 allows attackers to execute arbitrary commands via a crafted name of a photo file within the local photo library.
Matching passage: CVE-2015-3716. CWE: CWE-77. CVSS: 4.400000095367432. Spotlight in Apple OS X before 10.10.4 allows attackers to execute arbitrary commands via a crafted name of a photo file within the local photo library.
Near-miss passage: CVE-2015-5704. CWE: CWE-77. CVSS: 7.800000190734863. scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.
Query: risk of Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication 
Matching passage: CVE-2015-2755. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.
Near-miss passage: CVE-2015-2878. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist.
Query: Sigma rule for Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr
Matching passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Near-miss passage: Sigma rule: Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend E. Logsource: windows / process_creation. Rule: title: Hacktool - EDR-Freeze Execution id: c598cc0c-9e70-4852-b9eb-8921af79f598 status: experimental description: 'Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions. ' references: - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://github.com/TwoSevenOneT/EDR-Freeze author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 modified: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: Image|contains: - \EDR-Freeze - \EDRFreeze Image|endswith: .exe selection_imphash: Hashes|contains: - IMPHASH=1195F7935954A2CD09157390C33F8E8C - IMPHASH=129F58DE3D687FB7F012BF6C3D679997 - IMPHASH=2C617A175D0086251642C6619F7CC8BA - IMPHASH=8828F0B906F7844358FB92A899E9520F - IMPHASH=AF76D95157EC554DC1EF178E4E66D447 - IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5 - IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0 - IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7 condition: 1 of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze/info.yml
Query: telemetry for T1591.001
Matching passage: T1591.001 Determine Physical Locations. Tactics: reconnaissance. Description: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).
Near-miss passage: T1591.003 Identify Business Tempo. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))