alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Application Exhaustion Flood
Matching passage: T1499.003 Application Exhaustion Flood. Tactics: impact. Description: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Near-miss passage: T1499 Endpoint Denial of Service. Tactics: impact. Description: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. Botnets are commonly used to conduct DDoS attacks against networks and services. Large
Query: rule covering Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Matching passage: Sigma rule: Detects instances where a VNC service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - VNC Connection Attempt id: 9db5446c-b44a-4291-8b89-fcab5609c3b3 status: test description: Detects instances where a VNC service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.t1021 logsource: category: application product: opencanary detection: selection: logtype: 12001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution With Local RDP File id: 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock date: 2023-04-18 modified: 2023-04-30 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|endswith: - .rdp - .rdp" filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Likely with legitimate usage of ".rdp" files level: low
Query: rule covering Detects PowerShell core DLL being loaded by an Office Product
Matching passage: Sigma rule: Detects PowerShell core DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded Via Office Application id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a status: test description: Detects PowerShell core DLL being loaded by an Office Product references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 tags: - attack.stealth logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \outlook.exe - \onenote.exe - \onenoteim.exe - \powerpnt.exe - \winword.exe ImageLoaded|contains: - \System.Management.Automation.Dll - \System.Management.Automation.ni.Dll condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool. Logsource: linux / process_creation. Rule: title: UFW Disable Attempt id: 84c9e83c-599a-458a-a0cb-0ecce44e807a status: test description: 'Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources. ' references: - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 - https://manpages.debian.org/unstable/ufw/ufw-framework.8.en.html - https://www.cyberciti.biz/faq/linux-disable-firewall-command/ author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-18 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux category: process_creation detection: selection_ufw_init: Image|endswith: /ufw-init CommandLine|contains: - ' force-stop' - ' stop' - ' flush' selection_ufw_disable: CommandLine|contains|all: - 'ufw ' - disable condition: 1 of selection_* falsepositives: - Legitimate actions by system administrators to disable UFW. level: medium
Query: CVE similar to CVE-2015-1594
Matching passage: CVE-2015-1594. CWE: UNKNOWN. CVSS: 6.900000095367432. Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file.
Near-miss passage: CVE-2015-5404. CWE: UNKNOWN. CVSS: 7.5. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Query: patch priority for CVE-2015-4080
Matching passage: CVE-2015-4080. CWE: CWE-310. CVSS: 6.800000190734863. The Kankun Smart Socket device and mobile application uses a hardcoded AES 256 bit key, which makes it easier for remote attackers to (1) obtain sensitive information by sniffing the network and (2) obtain access to the device by encrypting messages.
Near-miss passage: CVE-2015-3324. CWE: CWE-310. CVSS: 4.300000190734863. The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers.
Query: patch priority for CVE-2015-5759
Matching passage: CVE-2015-5759. CWE: CWE-254. CVSS: 5.0. WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.
Near-miss passage: CVE-2015-4640. CWE: CWE-254. CVSS: 2.9000000953674316. The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
Query: alert when Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that new
Matching passage: Sigma rule: Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that new. Logsource: windows / process_creation. Rule: title: Explorer NOUACCHECK Flag id: 534f2ef7-e8a2-4433-816d-c91bccde289b status: test description: Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks references: - https://twitter.com/ORCA6665/status/1496478087244095491 author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \explorer.exe CommandLine|contains: /NOUACCHECK filter_dc_logon: - ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule - ParentImage: C:\Windows\System32\svchost.exe condition: selection and not 1 of filter_* falsepositives: - Domain Controller User Logon - Unknown how many legitimate software products use that method level: high
Near-miss passage: Sigma rule: Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system admi. Logsource: windows / registry_set. Rule: title: Disable Administrative Share Creation at Startup id: c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e status: test description: Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup author: frack113 date: 2022-01-16 modified: 2024-03-25 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\LanmanServer\Parameters\ TargetObject|endswith: - \AutoShareWks - \AutoShareServer Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/info.yml simulation: - type: atomic-red-team name: Disable Administrative Share Creation at Startup technique: T1070.005 atomic_guid: 99c657aa-ebeb-4179-a665-69288fdd12b8
Query: detect Detects the use of a Microsoft signed script executing a managed DLL with PowerShell. in logs
Matching passage: Sigma rule: Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.. Logsource: windows / process_creation. Rule: title: UtilityFunctions.ps1 Proxy Dll id: 0403d67d-6227-4ea8-8145-4e72db7da120 status: test description: Detects the use of a Microsoft signed script executing a managed DLL with PowerShell. references: - https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/ author: frack113 date: 2022-05-28 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - UtilityFunctions.ps1 - 'RegSnapin ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects risky authentication from a non AD registered device without MFA being required.. Logsource: azure / signinlogs. Rule: title: Suspicious SignIns From A Non Registered Device id: 572b12d4-9062-11ed-a1eb-0242ac120002 status: test description: Detects risky authentication from a non AD registered device without MFA being required. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-10 modified: 2025-07-02 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_main: Status: Success AuthenticationRequirement: singleFactorAuthentication RiskState: atRisk selection_empty1: DeviceDetail.trusttype: '' selection_empty2: DeviceDetail.trusttype: null condition: selection_main and 1 of selection_empty* falsepositives: - Unknown level: high
Query: rule covering Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service
Matching passage: Sigma rule: Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service. Logsource: windows / security. Rule: title: Password Change on Directory Service Restore Mode (DSRM) Account id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 related: - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 type: similar status: stable description: 'Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence. ' references: - https://adsecurity.org/?p=1714 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794 author: Thomas Patzke date: 2017-02-19 modified: 2020-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: 4794 condition: selection falsepositives: - Initial installation of a domain controller. level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Renamed MeshAgent Execution - Windows id: b471f462-eb0d-4832-be35-28d94bdb4780 related: - id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582 type: similar - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: derived status: experimental description: 'Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.stealth - attack.t1219.002 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_meshagent: - CommandLine|contains: --meshServiceName - OriginalFileName|contains: meshagent filter_main_legitimate: Image|endswith: \meshagent.exe condition: selection_meshagent and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: detect Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the in logs
Matching passage: Sigma rule: Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the. Logsource: windows / process_creation. Rule: title: Suspicious ArcSOC.exe Child Process id: 8e95e73e-ba02-4a87-b4d7-0929b8053038 status: experimental description: 'Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \ArcSOC.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wmic.exe - \wscript.exe filter_main_cmd: Image|endswith: \cmd.exe CommandLine: cmd.exe /c "ver" condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / security. Rule: title: T1047 Wmiprvse Wbemcomn DLL Hijack id: f6c68d5f-e101-4b86-8c84-7d96851fd65c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-02-24 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \wbem\wbemcomn.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Query: ATT&CK technique for Windows Remote Management
Matching passage: T1021.006 Windows Remote Management. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Near-miss passage: T1021.005 VNC. Tactics: lateral movement. Description: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: Havana authentication bug)
Query: alert when Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Matching passage: Sigma rule: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location. Logsource: windows / image_load. Rule: title: Microsoft Office DLL Sideload id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f status: test description: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2023-03-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \outllib.dll filter: ImageLoaded|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly". Logsource: windows / process_creation. Rule: title: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call id: 9c0295ce-d60d-40bd-bd74-84673b7592b1 related: - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59 type: similar status: test description: Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0 author: pH-T (Nextron Systems) date: 2022-03-01 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ - oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA - 6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA - OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ - oAOgAoACIATABvACIAKwAiAGEAZAAiACkA - 6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA - OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ - oAOgAoACIATABvAGEAIgArACIAZAAiACkA - 6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA - OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ - oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA - 6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA - OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ - oAOgAoACcATABvACcAKwAnAGEAZAAnACkA - 6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA - OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ - oAOgAoACcATABvAGEAJwArACcAZAAnACkA - 6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA condition: selection falsepositives: - Unlikely level: high