alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects suspicious process related to rasdial.exe
Matching passage: Sigma rule: Detects suspicious process related to rasdial.exe. Logsource: windows / process_creation. Rule: title: Suspicious RASdial Activity id: 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e status: test description: Detects suspicious process related to rasdial.exe references: - https://twitter.com/subTee/status/891298217907830785 author: juju4 date: 2019-01-16 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: rasdial.exe condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Near-miss passage: Sigma rule: Detects execution of "dsquery.exe" for domain trust discovery. Logsource: windows / process_creation. Rule: title: Domain Trust Discovery Via Dsquery id: 3bad990e-4848-4a78-9530-b427d854aac0 related: - id: b23fcb74-b1cb-4ff7-a31d-bfe2a7ba453b type: similar - id: 77815820-246c-47b8-9741-e0def3f57308 type: obsolete status: test description: Detects execution of "dsquery.exe" for domain trust discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843 author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72 date: 2019-10-24 modified: 2023-02-02 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsquery.exe - OriginalFileName: dsquery.exe selection_cli: CommandLine|contains: trustedDomain condition: all of selection_* falsepositives: - Legitimate use of the utilities by legitimate user for legitimate reason level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/info.yml simulation: - type: atomic-red-team name: Windows - Discover domain trusts with dsquery technique: T1482 atomic_guid: 4700a710-c821-4e17-a3ec-9e4c81d6845f
Query: write Sigma for Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U
Matching passage: Sigma rule: Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "U. Logsource: windows / file_event. Rule: title: Uncommon File Creation By Mysql Daemon Process id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf status: test description: 'Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware. ' references: - https://asec.ahnlab.com/en/58878/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/ author: Joseph Kamau date: 2024-05-27 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: Image|endswith: - \mysqld.exe - \mysqld-nt.exe TargetFilename|endswith: - .bat - .dat - .dll - .exe - .ps1 - .psm1 - .vbe - .vbs condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the f. Logsource: windows / file_event. Rule: title: PSEXEC Remote Execution File Artefact id: 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4 status: test description: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system references: - https://aboutdfir.com/the-key-to-identify-psexec/ - https://twitter.com/davisrichardg/status/1616518800584704028 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-21 modified: 2023-02-23 tags: - attack.lateral-movement - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1136.002 - attack.t1543.003 - attack.t1570 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\PSEXEC- TargetFilename|endswith: .key condition: selection falsepositives: - Unlikely level: high
Query: mitigate Cloud Account
Matching passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: Sigma rule for Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t
Matching passage: Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects activity when a security-enabled global group is deleted. Logsource: windows / security. Rule: title: A Security-Enabled Global Group Was Deleted id: b237c54b-0f15-4612-a819-44b735e0de27 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a security-enabled global group is deleted references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 4730 - 634 condition: selection falsepositives: - Unknown level: low
Query: CVE similar to CVE-2015-3292
Matching passage: CVE-2015-3292. CWE: CWE-17. CVSS: 10.0. The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-7035. CWE: CWE-17. CVSS: 7.5. Apple Mac EFI before 2015-002, as used in OS X before 10.11.1 and other products, mishandles arguments, which allows attackers to reach "unused" functions via unspecified vectors.
Query: Sigma rule for Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an att
Matching passage: Sigma rule: Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an att. Logsource: aws / cloudtrail. Rule: title: AWS Identity Center Identity Provider Change id: d3adb3ef-b7e7-4003-9092-1924c797db35 status: test description: 'Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation. ' references: - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html author: Michael McIntyre @wtfender date: 2023-09-27 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556 logsource: product: aws service: cloudtrail detection: selection: eventSource: - sso-directory.amazonaws.com - sso.amazonaws.com eventName: - AssociateDirectory - DisableExternalIdPConfigurationForDirectory - DisassociateDirectory - EnableExternalIdPConfigurationForDirectory condition: selection falsepositives: - Authorized changes to the AWS account's identity provider level: high
Near-miss passage: Sigma rule: Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon proces. Logsource: windows / file_event. Rule: title: Windows Terminal Profile Settings Modification By Uncommon Process id: 9b64de98-9db3-4033-bd7a-f51430105f00 status: test description: Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process. references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile - https://twitter.com/nas_bench/status/1550836225652686848 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.015 logsource: product: windows category: file_event detection: selection: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe TargetFilename|endswith: \AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json condition: selection falsepositives: - Some false positives may occur with admin scripts that set WT settings. level: medium
Query: exploit The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a
Matching passage: CVE-2015-8539. CWE: CWE-269. CVSS: 7.800000190734863. The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.
Near-miss passage: CVE-2015-0192. CWE: CWE-269. CVSS: 9.800000190734863. Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.
Query: rule covering Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Matching passage: Sigma rule: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host. Logsource: windows / security. Rule: title: WCE wceaux.dll Access id: 1de68c67-af5c-4097-9c85-fe5578e09e67 status: test description: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-14 modified: 2025-01-30 tags: - attack.credential-access - attack.t1003 - attack.s0005 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectName|endswith: \wceaux.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential. Logsource: windows / ps_script. Rule: title: Create Volume Shadow Copy with Powershell id: afd12fed-b0ec-45c9-a13d-aa86625dac81 status: test description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7 author: frack113 date: 2022-01-12 tags: - attack.credential-access - attack.t1003.003 - attack.ds0005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_ShadowCopy - ).Create( - ClientAccessible condition: selection falsepositives: - Legitimate PowerShell scripts level: high
Query: CVE similar to CVE-2015-6809
Matching passage: CVE-2015-6809. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to index.php/admin/saveConfig, the (2) data[stats_provider_url] parameter to index.php/areas/saveArea, or the (3) data[description] parameter to index.php/areas/saveSection.
Near-miss passage: CVE-2015-9355. CWE: CWE-79. CVSS: 6.099999904632568. The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Query: write Sigma for Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes
Matching passage: Sigma rule: Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes. Logsource: windows / process_creation. Rule: title: Msxsl.EXE Execution id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0 status: test description: 'Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: medium
Near-miss passage: Sigma rule: Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware. Logsource: windows / registry_set. Rule: title: AMSI Disabled via Registry Modification id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 related: - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 type: similar status: experimental description: 'Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned. ' references: - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
Query: risk of The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Matching passage: CVE-2015-7705. CWE: CWE-20. CVSS: 9.800000190734863. The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Near-miss passage: CVE-2015-8226. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Query: mitigate Kernel Modules and Extensions
Matching passage: T1547.006 Kernel Modules and Extensions. Tactics: persistence, privilege escalation. Description: Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming) When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0).(Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.(Citation: iDefense Rootkit Overview) Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.(Citation: System and kernel extensions in macOS) Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.(Citation: Apple Kernel Extension Deprecation) Adversaries can use LKMs and kexts to conduct [Persistence](https
Near-miss passage: T1547.010 Port Monitors. Tactics: persistence, privilege escalation. Description: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port