alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects potential mimikatz-like tools accessing LSASS from non system account in logs
Matching passage: Sigma rule: Detects potential mimikatz-like tools accessing LSASS from non system account. Logsource: windows / security. Rule: title: LSASS Access From Non System Account id: 962fe167-e48d-4fd6-9974-11e5b9a5d6d1 status: test description: Detects potential mimikatz-like tools accessing LSASS from non system account references: - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-06-20 modified: 2023-12-11 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: security detection: selection: EventID: - 4663 - 4656 AccessMask: - '0x100000' - '0x1010' - '0x1400' - '0x1410' - '0x1418' - '0x1438' - '0x143a' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' - '0x40' - 143a - 1f0fff - 1f1fff - 1f2fff - 1f3fff ObjectType: Process ObjectName|endswith: \lsass.exe filter_main_service_account: SubjectUserName|endswith: $ filter_main_generic: ProcessName|contains: - :\Program Files\ - :\Program Files (x86)\ filter_main_wmiprvse: ProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe AccessMask: '0x1410' filter_optional_steam: ProcessName|contains: \SteamLibrary\steamapps\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.. Logsource: windows / process_creation. Rule: title: Regsvr32 DLL Execution With Uncommon Extension id: 50919691-7302-437f-8e10-1fe088afa145 status: test description: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension. references: - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems) date: 2019-07-17 modified: 2023-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1574 - attack.execution logsource: category: process_creation product: windows detection: selection: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE filter_main_legit_ext: CommandLine|contains: - .ax - .cpl - .dll - .ocx filter_optional_pascal: CommandLine|contains: .ppl filter_optional_avg: CommandLine|contains: .bav filter_main_null_4688: CommandLine: null filter_main_empty_4688: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate extensions currently not in the list either from third party or specific Windows components. level: medium
Query: Lateral movement indicators for AutoHotKey & AutoIT
Matching passage: T1059.010 AutoHotKey & AutoIT. Tactics: execution. Description: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey) Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate) These scripts may also be compiled into self-contained executable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)
Near-miss passage: T1059.002 AppleScript. Tactics: execution. Description: Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely. Scripts can be run from the command-line via <code>osascript /path/to/script</code> or <code>osascript -e "script here"</code>. Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding <code>#!/usr/bin/osascript</code> to the start of the script file.(Citation: SentinelOne AppleScript) AppleScripts do not need to call <code>osascript</code> to execute. However, they may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s <code>NSAppleScript</code> or <code>OSAScript</code>, both of which execute code independent of the <code>/usr/bin/osascript</code> command line utility. Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team) Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques
Query: detection rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have
Matching passage: Sigma rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE id: d2451be2-b582-4e15-8701-4196ac180260 related: - id: ca5583e9-8f80-46ac-ab91-7f314d13b984 type: similar status: test description: 'Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe". ' references: - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/ - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ - https://twitter.com/Max_Mal_/status/1775222576639291859 - https://twitter.com/DTCERT/status/1712785426895839339 author: Swachchhanda Shrawan Poudel date: 2024-04-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: - \KeyScrambler.exe - \KeyScramblerLogon.exe ImageLoaded|endswith: \KeyScramblerIE.dll filter_main_legitimate_path: Image|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ ImageLoaded|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ filter_main_signature: Signature: QFX Software Corporation SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate the. Logsource: linux / auditd. Rule: title: Linux Capabilities Discovery id: fe10751f-1995-40a5-aaa2-c97ccb4123fe status: test description: Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. references: - https://man7.org/linux/man-pages/man8/getcap.8.html - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ - https://mn3m.info/posts/suid-vs-capabilities/ - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099 author: Pawel Mazur date: 2021-11-28 modified: 2022-12-25 tags: - attack.discovery - attack.privilege-escalation - attack.t1083 - attack.t1548 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: getcap a1: -r a2: / condition: selection falsepositives: - Unknown level: low
Query: patch priority for CVE-2015-8671
Matching passage: CVE-2015-8671. CWE: CWE-264. CVSS: 8.800000190734863. Huawei LogCenter V100R001C10 could allow an authenticated attacker to tamper with requests using a tool and submit a request to the server for privilege escalation, affecting some system functions.
Near-miss passage: CVE-2015-1739. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: detection engineering for Junk Data
Matching passage: T1001.001 Junk Data. Tactics: command and control. Description: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Near-miss passage: T1001.002 Steganography. Tactics: command and control. Description: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Query: detection rule: Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process
Matching passage: Sigma rule: Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process. Logsource: windows / process_creation. Rule: title: HackTool - HollowReaper Execution id: 85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5 status: experimental description: 'Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries. ' references: - https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.012 logsource: category: process_creation product: windows detection: selection: Image|endswith: \HollowReaper.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of Python web servers via command line interface (CLI). After gaining access to target systems, ad. Logsource: linux / process_creation. Rule: title: Python WebServer Execution - Linux id: 3f0f5957-04f8-4792-ad89-192b0303bde6 status: experimental description: 'Detects the execution of Python web servers via command line interface (CLI). After gaining access to target systems, adversaries may use Python''s built-in HTTP server modules to quickly establish a web server without requiring additional software. This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems. ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver - https://docs.python.org/3/library/http.server.html - https://docs.python.org/2/library/simplehttpserver.html author: Mohamed LAKRI date: 2025-10-17 tags: - attack.exfiltration - attack.t1048.003 logsource: product: linux category: process_creation detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_module: CommandLine|contains: - http.server - SimpleHTTPServer condition: all of selection_* falsepositives: - Testing or development activity level: medium
Query: vulnerability: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated us
Matching passage: CVE-2015-2618. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via unknown vectors related to Input validation.
Near-miss passage: CVE-2015-0427. CWE: UNKNOWN. CVSS: 3.200000047683716. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and CVE-2014-6595.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects parameters used by WMImplant. Logsource: windows / ps_script. Rule: title: WMImplant Hack Tool id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7 status: test description: Detects parameters used by WMImplant references: - https://github.com/FortyNorthSecurity/WMImplant author: NVISO date: 2020-03-26 modified: 2022-12-25 tags: - attack.execution - attack.t1047 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - WMImplant - ' change_user ' - ' gen_cli ' - ' command_exec ' - ' disable_wdigest ' - ' disable_winrm ' - ' enable_wdigest ' - ' enable_winrm ' - ' registry_mod ' - ' remote_posh ' - ' sched_job ' - ' service_mod ' - ' process_kill ' - ' active_users ' - ' basic_info ' - ' power_off ' - ' vacant_system ' - ' logon_events ' condition: selection falsepositives: - Administrative scripts that use the same keywords. level: high
Near-miss passage: Sigma rule: Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li. Logsource: windows / ps_script. Rule: title: DMSA Link Attributes Modified id: 9b111d8e-92e0-4153-88bc-daefc1333aba related: - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd type: similar status: experimental description: 'Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - .Put("msDS-ManagedAccountPrecededByLink - CN= condition: selection falsepositives: - Legitimate administrative tasks modifying these attributes. level: low
Query: write Sigma for Detects when an the Administrator role is assigned to an user or group.
Matching passage: Sigma rule: Detects when an the Administrator role is assigned to an user or group.. Logsource: okta / okta. Rule: title: Okta Admin Role Assigned to an User or Group id: 413d4a81-6c98-4479-9863-014785fd579c status: test description: Detects when an the Administrator role is assigned to an user or group. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.003 logsource: product: okta service: okta detection: selection: eventType: - group.privilege.grant - user.account.privilege.grant condition: selection falsepositives: - Administrator roles could be assigned to users or group by other admin users. level: medium
Near-miss passage: Sigma rule: Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in. Logsource: windows / process_creation. Rule: title: COM Object Execution via Xwizard.EXE id: 53d4bb30-3f36-4e8a-b078-69d36c4a79ff status: test description: 'Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ - https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-07 modified: 2024-08-15 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine: RunWizard CommandLine|re: \{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\} condition: selection falsepositives: - Unknown level: medium
Query: detect Systemd Timers
Matching passage: T1053.006 Systemd Timers. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the <code>systemctl</code> command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control) Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>. An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d)
Near-miss passage: T1053 Scheduled Task/Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security) Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)
Query: SOC alert related to Cloud Accounts
Matching passage: T1078.004 Cloud Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation) Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto [Remote Services](https://attack.mitre.org/techniques/T1021). High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) to run commands on hybrid-joined devices. An adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication. Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversar
Near-miss passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.