alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects potentially suspicious child processes launched via the ScreenConnect client service.
Matching passage: Sigma rule: Detects potentially suspicious child processes launched via the ScreenConnect client service.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5 related: - id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a type: derived status: test description: 'Detects potentially suspicious child processes launched via the ScreenConnect client service. ' references: - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale date: 2022-02-25 modified: 2024-02-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: process_creation detection: selection: ParentCommandLine|contains|all: - :\Windows\TEMP\ScreenConnect\ - run.cmd Image|endswith: - \bitsadmin.exe - \cmd.exe - \curl.exe - \dllhost.exe - \net.exe - \nltest.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \wevtutil.exe condition: selection falsepositives: - If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed. level: medium
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - Unusual Volume of File Deletion id: 78a34b67-3c39-4886-8fb4-61c46dc18ecd status: test description: Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: austinsonger date: 2021-08-19 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Unusual volume of file deletion status: success condition: selection falsepositives: - Unknown level: medium
Query: alert when Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported i
Matching passage: Sigma rule: Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported i. Logsource: jvm / application. Rule: title: Potential OGNL Injection Exploitation In JVM Based Application id: 4d0af518-828e-4a04-a751-a7d03f3046ad status: test description: 'Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE''s such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134) ' references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 - cve.2017-5638 - cve.2022-26134 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - org.apache.commons.ognl.OgnlException - ExpressionSyntaxException condition: keywords falsepositives: - Application bugs level: high
Near-miss passage: Sigma rule: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.c. Logsource: zeek / http. Rule: title: Executable from Webdav id: aac2fd97-bcba-491b-ad66-a6edf89c71bf status: test description: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/ references: - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html - https://github.com/OTRF/detection-hackathon-apt29 author: SOC Prime, Adam Swan date: 2020-05-01 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1105 logsource: product: zeek service: http detection: selection_webdav: - c-useragent|contains: WebDAV - c-uri|contains: webdav selection_executable: - resp_mime_types|contains: dosexec - c-uri|endswith: .exe condition: selection_webdav and selection_executable falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5669
Matching passage: CVE-2015-5669. CWE: UNKNOWN. CVSS: 6.5. Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-3038. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: containment actions for EDR alert: possible Invalid Code Signature (T1036.001)
Matching passage: Playbook for T1036.001 Invalid Code Signature. 1) Validate alert telemetry against T1036.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program.
Near-miss passage: Playbook for T1036.006 Space after Filename. Different response path focused on stealth.
Query: SIEM correlation: command and control activity consistent with Web Protocols
Matching passage: T1071.001 Web Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: risk of Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the provenance of this information is unknow
Matching passage: CVE-2015-1201. CWE: UNKNOWN. CVSS: 5.0. Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Near-miss passage: CVE-2015-0346. CWE: UNKNOWN. CVSS: 10.0. Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0359.
Query: describe CVE-2015-10124
Matching passage: CVE-2015-10124. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the function add_views/show_views of the file functions.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 0.9 is able to address this issue. The patch is identified as a99667d11ac8d320006909387b100e9a8b5c12e1. It is recommended to upgrade the affected component. VDB-241026 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-8261. CWE: CWE-89. CVSS: 9.800000190734863. The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request.
Query: write Sigma for Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. Th
Matching passage: Sigma rule: Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. Th. Logsource: windows / process_creation. Rule: title: BitLockerTogo.EXE Execution id: 7f2376f9-42ee-4dfc-9360-fecff9a88fc8 status: test description: 'Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing. ' references: - https://tria.ge/240521-ynezpagf56/behavioral1 - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091 - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/ - https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/ author: Josh Nickels, mttaggart date: 2024-07-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \BitLockerToGo.exe condition: selection falsepositives: - Legitimate usage of BitLockerToGo.exe to encrypt portable devices. level: low
Near-miss passage: Sigma rule: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_set. Rule: title: Wdigest Enable UseLogonCredential id: d6a9b252-c666-4de6-8806-5561bbbd3bdc status: test description: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials references: - https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649 - https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-09-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: WDigest\UseLogonCredential Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-9271
Matching passage: CVE-2015-9271. CWE: CWE-434. CVSS: 9.800000190734863. The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Near-miss passage: CVE-2015-4455. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Query: risk of The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote auth
Matching passage: CVE-2015-5268. CWE: CWE-200. CVSS: 4.300000190734863. The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
Near-miss passage: CVE-2015-1488. CWE: CWE-200. CVSS: 4.0. An unspecified action handler in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via unknown vectors.
Query: alert when Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34). Logsource: windows / process_creation. Rule: title: UAC Bypass Using Disk Cleanup id: b697e69c-746f-4a86-9f59-7bfff8eab881 status: test description: Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: '"\system32\cleanmgr.exe /autoclean /d C:' ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting. Logsource: windows / process_creation. Rule: title: Use of OpenConsole id: 814c95cc-8192-4378-a70a-f1aafd877af1 status: test description: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting references: - https://twitter.com/nas_bench/status/1537563834478645252 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: OpenConsole.exe - Image|endswith: \OpenConsole.exe filter: Image|startswith: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal condition: selection and not filter falsepositives: - Legitimate use by an administrator level: medium
Query: containment actions for Lateral movement indicators for Modify or Spoof Tool UI
Matching passage: Playbook for T1685.003 Modify or Spoof Tool UI. 1) Validate alert telemetry against T1685.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typic
Near-miss passage: Playbook for T1685.001 Disable or Modify Windows Event Log. Different response path focused on defense impairment.
Query: alert when Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - in
Matching passage: Sigma rule: Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - in. Logsource: linux / process_creation. Rule: title: Suspicious Download and Execute Pattern via Curl/Wget id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa status: experimental description: 'Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks. ' references: - https://gtfobins.github.io/gtfobins/wget/ - https://gtfobins.github.io/gtfobins/curl/ author: Aayush Gupta date: 2025-06-17 tags: - attack.execution - attack.t1059.004 - attack.t1203 logsource: category: process_creation product: linux detection: selection_downloader: CommandLine|contains: - /curl - /wget selection_tmp: CommandLine|contains: - /tmp/ - /dev/shm/ selection_executor: CommandLine|contains: sh -c condition: all of selection_* falsepositives: - System update scripts using temporary files - Installer scripts or automated provisioning tools level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Anydesk Execution From Suspicious Folder id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86 related: - id: b52e84a3-029e-4529-b09b-71d19dd27e94 type: similar status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-05-20 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH filter: Image|contains: - \AppData\ - Program Files (x86)\AnyDesk - Program Files\AnyDesk condition: selection and not filter falsepositives: - Legitimate use of AnyDesk from a non-standard folder level: high
Query: vulnerability: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP 
Matching passage: CVE-2015-1849. CWE: CWE-200. CVSS: 5.900000095367432. AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Near-miss passage: CVE-2015-6556. CWE: CWE-200. CVSS: 2.299999952316284. EACommunicatorSrv.exe in the Framework Service in the client in Symantec Endpoint Encryption (SEE) before 11.1.0 allows remote authenticated users to discover credentials by triggering a memory dump.
Query: Encoded PowerShell / command-line abuse matching Compromise Software Supply Chain
Matching passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Near-miss passage: T1195 Supply Chain Compromise. Tactics: initial access. Description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.