alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
Matching passage: Sigma rule: Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings. Logsource: linux / process_creation. Rule: title: Local Groups Discovery - Linux id: 676381a6-15ca-4d73-a9c8-6a22e970b90d status: test description: Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-10-11 modified: 2025-06-04 tags: - attack.discovery - attack.t1069.001 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /groups selection_2: Image|endswith: - /cat - /ed - /head - /less - /more - /nano - /tail - /vi - /vim CommandLine|contains: /etc/group condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may the. Logsource: windows / process_creation. Rule: title: HackTool - WinRM Access Via Evil-WinRM id: a197e378-d31b-41c0-9635-cfdf1c1bb423 status: test description: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm - https://github.com/Hackplayers/evil-winrm author: frack113 date: 2022-01-07 modified: 2023-02-13 tags: - attack.lateral-movement - attack.t1021.006 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ruby.exe CommandLine|contains|all: - '-i ' - '-u ' - '-p ' condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-9368
Matching passage: CVE-2015-9368. CWE: CWE-79. CVSS: 6.099999904632568. Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-0298. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
Query: what is T1585.002
Matching passage: T1585.002 Email Accounts. Tactics: resource development. Description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
Near-miss passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Query: common weakness: Incorrect Permission Assignment for Critical Resource
Matching passage: CWE-732 Incorrect Permission Assignment for Critical Resource. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Near-miss passage: CWE-356 Product UI does not Warn User of Unsafe Actions. The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
Query: detect Detects when an ElastiCache security group has been created. in logs
Matching passage: Sigma rule: Detects when an ElastiCache security group has been created.. Logsource: aws / cloudtrail. Rule: title: AWS ElastiCache Security Group Created id: 4ae68615-866f-4304-b24b-ba048dfa5ca7 status: test description: Detects when an ElastiCache security group has been created. references: - https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.persistence - attack.t1136 - attack.t1136.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticache.amazonaws.com eventName: CreateCacheSecurityGroup condition: selection falsepositives: - A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an atta. Logsource: aws / cloudtrail. Rule: title: Ingress/Egress Security Group Modification id: 6fb77778-040f-4015-9440-572aa9b6b580 status: test description: 'Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: - AuthorizeSecurityGroupEgress - AuthorizeSecurityGroupIngress - RevokeSecurityGroupEgress - RevokeSecurityGroupIngress condition: selection falsepositives: - New VPCs and Subnets being setup requiring a different security profile to those already defined - A single port being opened for a new service that is known to be deploying - Administrators closing unused ports to reduce the attack surface level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers. Logsource: windows / process_creation. Rule: title: Python One-Liners with Base64 Decoding id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b related: - id: 55e862a8-dd9c-4651-807a-f21fcad56716 type: similar status: experimental description: 'Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion. ' references: - https://docs.python.org/3/library/base64.html - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-09 tags: - attack.execution - attack.stealth - attack.t1059.006 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \python - OriginalFileName|contains: python selection_cli: CommandLine|contains|all: - import - base64 - ' -c' CommandLine|contains: - .decode - b16decode - b32decode - b32hexdecode - b64decode - b85decode - z85decode condition: all of selection_* falsepositives: - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
Near-miss passage: Sigma rule: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection ch. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Encoded Command Patterns id: b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c status: test description: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_flags: CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' selection_encoded: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aWV4I' - ' IAB' - ' PAA' - ' aQBlAHgA' filter_gcworker: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Other tools that work with encoded scripts in the command line instead of script files level: high
Query: vulnerability: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-up
Matching passage: CVE-2015-0340. CWE: UNKNOWN. CVSS: 5.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.
Near-miss passage: CVE-2015-4871. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Query: vulnerability: libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file.
Matching passage: CVE-2015-8750. CWE: CWE-476. CVSS: 6.5. libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file.
Near-miss passage: CVE-2015-7549. CWE: CWE-476. CVSS: 6.0. The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.
Query: how to detect Network Share Discovery
Matching passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Near-miss passage: T1497.001 System Checks. Tactics: stealth, discovery. Description: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Once executed, malware may also use [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) to check if it was saved in a folder or file with unexpected or even analysis-related naming artifacts such as `malware`, `sample`, or `hash`. Other common checks may enumerate services running that are unique to these applications, installed programs on the
Query: CVE similar to CVE-2015-1107
Matching passage: CVE-2015-1107. CWE: UNKNOWN. CVSS: 1.899999976158142. The Lock Screen component in Apple iOS before 8.3 does not properly implement the erasure feature for incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses.
Near-miss passage: CVE-2015-0332. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0333, CVE-2015-0335, and CVE-2015-0339.
Query: CVE similar to CVE-2015-5751
Matching passage: CVE-2015-5751. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-7552. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
Query: what is T1578.003
Matching passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.002 Create Cloud Instance. Tactics: defense impairment. Description: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Query: detection rule: Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co
Matching passage: Sigma rule: Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure id: 70ed1d26-0050-4b38-a599-92c53d57d45a status: test description: 'Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Near-miss passage: Sigma rule: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSPUB.EXE id: 3b3c7f55-f771-4dd6-8a6e-08d057a17caf status: test description: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-02-08 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSPUB.exe - OriginalFileName: MSPUB.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to
Matching passage: CVE-2015-3626. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname.
Near-miss passage: CVE-2015-1180. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.