alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / process_creation. Rule: title: Potential Active Directory Enumeration Using AD Module - ProcCreation id: 70bc5215-526f-4477-963c-a47a5c9ebd12 related: - id: 9e620995-f2d8-4630-8430-4afd89f77604 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113 date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Import-Module ' - 'ipmo ' selection_dll: CommandLine|contains: Microsoft.ActiveDirectory.Management.dll condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Near-miss passage: Sigma rule: Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen. Logsource: windows / process_creation. Rule: title: Potential Powershell ReverseShell Connection id: edc2f8ae-2412-4dfd-b9d5-0c57727e70be status: stable description: Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other. references: - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Shells/Invoke-PowerShellTcpOneLine.ps1 author: FPT.EagleEye, wagga, Nasreddine Bencherchali (Nextron Systems) date: 2021-03-03 modified: 2023-04-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cli: CommandLine|contains|all: - ' Net.Sockets.TCPClient' - .GetStream( - .Write( condition: all of selection_* falsepositives: - In rare administrative cases, this function might be used to check network connectivity level: high
Query: vulnerability: The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9362. CWE: CWE-79. CVSS: 6.099999904632568. The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-7383. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the (1) adminUserName, (2) pathToMYSQL, (3) databaseStructureFile, or (4) pathToBibutils parameter to install.php or the (5) adminUserName parameter to update.php.
Query: vulnerability: HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to execute arbitrary code or cause a denial of service via unspecified vectors.
Matching passage: CVE-2015-5410. CWE: UNKNOWN. CVSS: 6.5. HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to execute arbitrary code or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-0430. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility.
Query: detection rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is
Matching passage: Sigma rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is. Logsource: windows / process_access. Rule: title: Potential Credential Dumping Activity Via LSASS id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da status: test description: 'Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. ' references: - https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md - https://research.splunk.com/endpoint/windows_possible_credential_dumping/ author: Samir Bousseaden, Michael Haag date: 2019-04-03 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess|contains: - '0x1038' - '0x1438' - '0x143a' - '0x1fffff' CallTrace|contains: - dbgcore.dll - dbghelp.dll - kernel32.dll - kernelbase.dll - ntdll.dll filter_main_system_user: SourceUser|contains: - AUTHORI - AUTORI filter_optional_thor: CallTrace|contains|all: - :\Windows\Temp\asgard2-agent\ - \thor\thor64.exe+ - '|UNKNOWN(' GrantedAccess: '0x103800' filter_optional_sysmon: SourceImage|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the nscurl utility in order to download files.. Logsource: macos / process_creation. Rule: title: File Download Via Nscurl - MacOS id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf status: test description: Detects the execution of the nscurl utility in order to download files. references: - https://www.loobins.io/binaries/nscurl/ - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd author: Daniel Cortez date: 2024-06-04 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: macos detection: selection: Image|endswith: /nscurl CommandLine|contains: - '--download ' - '--download-directory ' - '--output ' - '-dir ' - '-dl ' - -ld - '-o ' condition: selection falsepositives: - Legitimate usage of nscurl by administrators and users. level: medium
Query: write Sigma for Identifies user activities originating from geographically distant locations within a time period shorter than the time
Matching passage: Sigma rule: Identifies user activities originating from geographically distant locations within a time period shorter than the time. Logsource: azure / riskdetection. Rule: title: Impossible Travel id: b2572bf9-e20a-4594-b528-40bde666525a status: test description: Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: impossibleTravel condition: selection falsepositives: - Connecting to a VPN, performing activity and then dropping and performing additional activity. level: high
Near-miss passage: Sigma rule: Detects indicators of a UAC bypass method by mocking directories. Logsource: windows / process_creation. Rule: title: TrustedPath UAC Bypass Pattern id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126 related: - id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290 type: similar status: test description: Detects indicators of a UAC bypass method by mocking directories references: - https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows - https://github.com/netero1010/TrustedPath-UACBypass-BOF - https://x.com/Wietze/status/1933495426952421843 author: Florian Roth (Nextron Systems) date: 2021-08-27 modified: 2025-06-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|contains: - C:\Windows \System32\ - C:\Windows \SysWOW64\ condition: selection falsepositives: - Unknown level: critical
Query: vulnerability: Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive.
Matching passage: CVE-2015-0907. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive.
Near-miss passage: CVE-2015-5944. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
Query: write Sigma for Detects any assembly DLL being loaded by an Office Product
Matching passage: Sigma rule: Detects any assembly DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: DotNET Assembly DLL Loaded Via Office Application id: ff0f2b05-09db-4095-b96d-1b75ca24894a status: test description: Detects any assembly DLL being loaded by an Office Product references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-03-29 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \onenote.exe - \onenoteim.exe - \outlook.exe - \powerpnt.exe - \winword.exe ImageLoaded|startswith: C:\Windows\assembly\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen. Logsource: windows / system. Rule: title: Uncommon Service Installation Image Path id: 26481afe-db26-4228-b264-25a29fe6efc7 related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b type: derived status: test description: 'Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc. ' references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2024-02-09 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 suspicious_paths: ImagePath|contains: - \\\\.\\pipe - \Users\Public\ - \Windows\Temp\ suspicious_encoded_flag: ImagePath|contains: ' -e' suspicious_encoded_keywords: ImagePath|contains: - ' aQBlAHgA' - ' aWV4I' - ' IAB' - ' JAB' - ' PAA' - ' SQBFAFgA' - ' SUVYI' filter_optional_thor_remote: ImagePath|startswith: C:\WINDOWS\TEMP\thor10-remote\thor64.exe filter_main_defender_def_updates: ImagePath|startswith: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ condition: selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: rule covering Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36). Logsource: windows / process_creation. Rule: title: UAC Bypass Using NTFS Reparse Point - Process id: 39ed3c80-e6a1-431b-9df3-911ac53d08a7 status: test description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection1: CommandLine|startswith: '"C:\Windows\system32\wusa.exe" /quiet C:\Users\' CommandLine|endswith: \AppData\Local\Temp\update.msu IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 selection2: ParentCommandLine: '"C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Windows\system32\pe386" /ignorecheck' IntegrityLevel: - High - System CommandLine|contains|all: - C:\Users\ - \AppData\Local\Temp\ - \dismhost.exe { Image|endswith: \DismHost.exe condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of the nscurl utility in order to download files.. Logsource: macos / process_creation. Rule: title: File Download Via Nscurl - MacOS id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf status: test description: Detects the execution of the nscurl utility in order to download files. references: - https://www.loobins.io/binaries/nscurl/ - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd author: Daniel Cortez date: 2024-06-04 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: macos detection: selection: Image|endswith: /nscurl CommandLine|contains: - '--download ' - '--download-directory ' - '--output ' - '-dir ' - '-dl ' - -ld - '-o ' condition: selection falsepositives: - Legitimate usage of nscurl by administrators and users. level: medium
Query: CVE similar to CVE-2015-0634
Matching passage: CVE-2015-0634. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310.
Near-miss passage: CVE-2015-8687. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
Query: explain T1011.001 Exfiltration Over Bluetooth
Matching passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: campaign using Confluence
Matching passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.006 Databases. Tactics: collection. Description: Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)
Query: detect A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co in logs
Matching passage: Sigma rule: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co. Logsource: windows / ps_module. Rule: title: PowerShell Get Clipboard id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78 status: test description: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/16 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2023-01-04 tags: - attack.collection - attack.t1115 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains: Get-Clipboard condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the usage of the unsafe bpftrace option. Logsource: linux / process_creation. Rule: title: BPFtrace Unsafe Option Usage id: f8341cb2-ee25-43fa-a975-d8a5a9714b39 status: test description: Detects the usage of the unsafe bpftrace option references: - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/ - https://bpftrace.org/ author: Andreas Hunkeler (@Karneades) date: 2022-02-11 tags: - attack.execution - attack.t1059.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: bpftrace CommandLine|contains: --unsafe condition: selection falsepositives: - Legitimate usage of the unsafe option level: medium
Query: describe CVE-2015-3359
Matching passage: CVE-2015-3359. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Room Reservations module before 7.x-1.1 for Drupal allow remote authenticated users with the "Administer the room reservations system" permission to inject arbitrary web script or HTML via the (1) node title of a "Room Reservations Category" or (2) body of a "Room Reservations Room" node.
Near-miss passage: CVE-2015-0918. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php.
Query: Sigma rule for Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
Matching passage: Sigma rule: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering. Logsource: windows / process_creation. Rule: title: Sysinternals PsService Execution id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f status: test description: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: psservice.exe - Image|endswith: - \PsService.exe - \PsService64.exe - \PsService64a.exe condition: selection falsepositives: - Legitimate use of PsService by an administrator level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious child processes of KeyScrambler.exe. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process of KeyScrambler.exe id: ca5583e9-8f80-46ac-ab91-7f314d13b984 related: - id: d2451be2-b582-4e15-8701-4196ac180260 type: similar status: test description: Detects potentially suspicious child processes of KeyScrambler.exe references: - https://twitter.com/DTCERT/status/1712785421845790799 author: Swachchhanda Shrawan Poudel date: 2024-05-13 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1203 - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \KeyScrambler.exe selection_binaries: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - mshta.exe - PowerShell.EXE - pwsh.dll - regsvr32.exe - RUNDLL32.EXE - wscript.exe condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-2894
Matching passage: CVE-2015-2894. CWE: CWE-134. CVSS: 5.300000190734863. Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers.
Near-miss passage: CVE-2015-8617. CWE: CWE-134. CVSS: 9.800000190734863. Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.