alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for velocity / application
Matching passage: Sigma rule: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and ma. Logsource: velocity / application. Rule: title: Potential Server Side Template Injection In Velocity id: 16c86189-b556-4ee8-b4c7-7e350a195a4f status: test description: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE. references: - https://antgarsil.github.io/posts/velocity/ - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: velocity definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - ParseErrorException - VelocityException - TemplateInitException condition: keywords falsepositives: - Application bugs - Missing .vm files level: high
Near-miss passage: Sigma rule: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.. Logsource: windows / process_creation. Rule: title: Regsvr32 DLL Execution With Uncommon Extension id: 50919691-7302-437f-8e10-1fe088afa145 status: test description: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension. references: - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems) date: 2019-07-17 modified: 2023-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1574 - attack.execution logsource: category: process_creation product: windows detection: selection: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE filter_main_legit_ext: CommandLine|contains: - .ax - .cpl - .dll - .ocx filter_optional_pascal: CommandLine|contains: .ppl filter_optional_avg: CommandLine|contains: .bav filter_main_null_4688: CommandLine: null filter_main_empty_4688: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate extensions currently not in the list either from third party or specific Windows components. level: medium
Query: Sigma rule for Detects AWS root account usage
Matching passage: Sigma rule: Detects AWS root account usage. Logsource: aws / cloudtrail. Rule: title: AWS Root Credentials id: 8ad1600d-e9dc-4251-b0ee-a65268f29add status: test description: Detects AWS root account usage references: - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection_usertype: userIdentity.type: Root selection_eventtype: eventType: AwsServiceEvent condition: selection_usertype and not selection_eventtype falsepositives: - AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".a. Logsource: windows / process_creation. Rule: title: Suspicious Electron Application Child Processes id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 related: - id: 378a05d8-963c-46c9-bcce-13c7657eac99 type: similar status: test description: 'Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule) ' references: - https://taggart-tech.com/quasar-electron/ - https://github.com/mttaggart/quasar - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-21 modified: 2024-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \chrome.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \teams.exe selection_child_image: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \whoami.exe - \wscript.exe selection_child_paths: Image|contains: - :\ProgramData\ - :\Temp\ - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ filter_optional_discord: ParentImage|endswith: \Discord.exe Image|endswith: \cmd.exe CommandLine|contains: \NVSMI\nvidia-smi.exe condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: SOC alert related to Remote Service Session Hijacking
Matching passage: T1563 Remote Service Session Hijacking. Tactics: lateral movement. Description: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
Near-miss passage: T1563.001 SSH Hijacking. Tactics: lateral movement. Description: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.(Citation: Slideshare Abusing SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack) [SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) differs from use of [SSH](https://attack.mitre.org/techniques/T1021/004) because it hijacks an existing SSH session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Query: weakness Return of Stack Variable Address
Matching passage: CWE-562 Return of Stack Variable Address. A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
Near-miss passage: CWE-793 Only Filtering One Instance of a Special Element. The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
Query: risk of IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manag
Matching passage: CVE-2015-7449. CWE: CWE-200. CVSS: 3.299999952316284. IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager (RQM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Team Concert (RTC) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Requirements Composer (RRC) 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 before iFix1, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2 allow local users to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 108221.
Near-miss passage: CVE-2015-1357. CWE: CWE-200. CVSS: 5.0. Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
Query: risk of The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism, and consequen
Matching passage: CVE-2015-6109. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism, and consequently discover a driver base address, via a crafted application, aka "Windows Kernel Memory Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-3293. CWE: CWE-200. CVSS: 4.0. FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command.
Query: vulnerability: RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API metho
Matching passage: CVE-2015-1613. CWE: CWE-200. CVSS: 4.0. RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API method.
Near-miss passage: CVE-2015-0527. CWE: CWE-200. CVSS: 2.0999999046325684. EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform (xCP) provisioning, which allows local users to obtain sensitive information by reading a file.
Query: detection rule: Detects potential DLL sideloading of "DbgModel.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "DbgModel.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DbgModel.DLL id: fef394cd-f44d-4040-9b18-95d92fe278c0 status: test description: Detects potential DLL sideloading of "DbgModel.dll" references: - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html author: Gary Lobermier date: 2024-07-11 modified: 2024-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \dbgmodel.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_windbg: ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_ filter_optional_windows_kits: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Near-miss passage: Sigma rule: Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterp. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Application Access Level Modified id: 22f2fb54-5312-435d-852f-7c74f81684ca status: test description: 'Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace''s way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources. ' references: - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings - https://support.google.com/a/answer/9261439 author: Bryan Lim date: 2024-01-12 tags: - attack.persistence - attack.privilege-escalation - attack.t1098.003 logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: CHANGE_APPLICATION_SETTING setting_name|startswith: ContextAwareAccess condition: selection falsepositives: - Legitimate administrative activities changing the access levels for an application level: medium
Query: risk of libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_dec
Matching passage: CVE-2015-7507. CWE: CWE-125. CVSS: 7.5. libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_decode_rle function.
Near-miss passage: CVE-2015-8920. CWE: CWE-125. CVSS: 5.5. The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.
Query: Multiple failed authentications followed by Query Registry
Matching passage: T1012 Query Registry. Tactics: discovery. Description: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: write Sigma for Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin
Matching passage: Sigma rule: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin. Logsource: linux / sshd. Rule: title: Suspicious OpenSSH Daemon Error id: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc status: test description: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml author: Florian Roth (Nextron Systems) date: 2017-06-30 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: sshd detection: keywords: - unexpected internal error - unknown or unsupported key type - invalid certificate signing key - invalid elliptic curve value - incorrect signature - error in libcrypto - unexpected bytes remain after decoding - 'fatal: buffer_get_string: bad string' - 'Local: crc32 compensation attack' - bad client public DH value - Corrupted MAC on input condition: keywords falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the export of a crital Registry key to a file.. Logsource: windows / process_creation. Rule: title: Exports Critical Registry Keys To a File id: 82880171-b475-4201-b811-e9c826cd5eaa related: - id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a type: similar status: test description: Detects the export of a crital Registry key to a file. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-12 modified: 2024-03-13 tags: - attack.exfiltration - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli_1: CommandLine|contains|windash: ' -E ' selection_cli_2: CommandLine|contains: - hklm - hkey_local_machine selection_cli_3: CommandLine|endswith: - \system - \sam - \security condition: all of selection_* falsepositives: - Dumping hives for legitimate purpouse i.e. backup or forensic investigation level: high
Query: detect Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the in logs
Matching passage: Sigma rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the. Logsource: webserver. Rule: title: F5 BIG-IP iControl Rest API Command Execution - Webserver id: 85254a62-22be-4239-b79c-2ec17e566c37 related: - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17 type: similar status: test description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP references: - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029 - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516 author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-11-08 tags: - attack.execution - attack.t1190 - attack.initial-access logsource: category: webserver detection: selection: cs-method: POST cs-uri-query|endswith: /mgmt/tm/util/bash condition: selection falsepositives: - Legitimate usage of the BIG IP REST API to execute command for administration purposes level: medium
Near-miss passage: Sigma rule: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report. Logsource: windows / system. Rule: title: Moriya Rootkit - System id: 25b9c01c-350d-4b95-bed1-836d04a4f324 status: test description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report references: - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831 author: Bhabesh Raj date: 2021-05-06 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: ZzNetSvc condition: selection falsepositives: - Unknown level: critical
Query: rule covering Detects suspicious DNS queries to Monero mining pools
Matching passage: Sigma rule: Detects suspicious DNS queries to Monero mining pools. Logsource: dns. Rule: title: Monero Crypto Coin Mining Pool Lookup id: b593fd50-7335-4682-a36c-4edcb68e4641 status: stable description: Detects suspicious DNS queries to Monero mining pools references: - https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/ author: Florian Roth (Nextron Systems) date: 2021-10-24 tags: - attack.impact - attack.t1496 - attack.exfiltration - attack.t1567 logsource: category: dns detection: selection: query|contains: - pool.minexmr.com - fr.minexmr.com - de.minexmr.com - sg.minexmr.com - ca.minexmr.com - us-west.minexmr.com - pool.supportxmr.com - mine.c3pool.com - xmr-eu1.nanopool.org - xmr-eu2.nanopool.org - xmr-us-east1.nanopool.org - xmr-us-west1.nanopool.org - xmr-asia1.nanopool.org - xmr-jp1.nanopool.org - xmr-au1.nanopool.org - xmr.2miners.com - xmr.hashcity.org - xmr.f2pool.com - xmrpool.eu - pool.hashvault.pro condition: selection falsepositives: - Legitimate crypto coin mining level: high
Near-miss passage: Sigma rule: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Def. Logsource: windows / process_creation. Rule: title: Windows Defender Definition Files Removed id: 9719a8aa-401c-41af-8108-ced7ec9cd75c status: test description: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ author: frack113 date: 2021-07-07 modified: 2023-07-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MpCmdRun.exe - OriginalFileName: MpCmdRun.exe selection_cli: CommandLine|contains|all: - ' -RemoveDefinitions' - ' -All' condition: all of selection_* falsepositives: - Unknown level: high