alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Define a baseline threshold for failed sign-ins due to Conditional Access failures
Matching passage: Sigma rule: Define a baseline threshold for failed sign-ins due to Conditional Access failures. Logsource: azure / signinlogs. Rule: title: Sign-in Failure Due to Conditional Access Requirements Not Met id: b4a6d707-9430-4f5f-af68-0337f52d5c42 status: test description: Define a baseline threshold for failed sign-ins due to Conditional Access failures references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts author: Yochana Henderson, '@Yochana-H' date: 2022-06-01 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1110 - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 53003 Resultdescription: Blocked by Conditional Access condition: selection falsepositives: - Service Account misconfigured - Misconfigured Systems - Vulnerability Scanners level: high
Near-miss passage: Sigma rule: Detects activity when The Windows Defender Firewall service failed to load Group Policy. Logsource: windows / firewall-as. Rule: title: The Windows Defender Firewall Service Failed To Load Group Policy id: 7ec15688-fd24-4177-ba43-1a950537ee39 status: test description: Detects activity when The Windows Defender Firewall service failed to load Group Policy references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2023-01-17 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: 2009 condition: selection level: low
Query: vulnerability: Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary code via unknown vectors
Matching passage: CVE-2015-6857. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-3138.
Near-miss passage: CVE-2015-4813. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.
Query: alert when Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to m
Matching passage: Sigma rule: Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to m. Logsource: linux / process_creation. Rule: title: Scheduled Task/Job At id: d2d642d7-b393-43fe-bae4-e81ed5915c4b status: stable description: 'Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md author: Ömer Günal, oscd.community date: 2020-10-06 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /at - /atd condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow u. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Deleted id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a status: experimental description: 'Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: DeleteGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail deletion by authorized identities. level: medium
Query: playbook for alert: Persistence mechanism resembling Rundll32
Matching passage: Playbook for T1218.011 Rundll32. 1) Validate alert telemetry against T1218.011. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL
Near-miss passage: Playbook for T1218.003 CMSTP. Different response path focused on stealth.
Query: CVE similar to CVE-2015-1930
Matching passage: CVE-2015-1930. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-8893. CWE: CWE-119. CVSS: 5.5. app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to cause a denial of service (OS outage or buffer over-read) via a crafted application, aka Android internal bug 28822690 and Qualcomm internal bug CR822275.
Query: risk of Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.2.4 allows remote authenticated users to affect integrity via unknown vectors
Matching passage: CVE-2015-4741. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.2.4 allows remote authenticated users to affect integrity via unknown vectors related to Dialog popup.
Near-miss passage: CVE-2015-4692. CWE: UNKNOWN. CVSS: 4.900000095367432. The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.
Query: vulnerability: Memory leak in Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (memory consumption) via crafted Common Industrial Protocol (CIP) TCP
Matching passage: CVE-2015-0648. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (memory consumption) via crafted Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun49658.
Near-miss passage: CVE-2015-0283. CWE: CWE-399. CVSS: 7.800000190734863. The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.
Query: exploit Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-1712. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1691.
Near-miss passage: CVE-2015-8981. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Query: write Sigma for Detects the installation of a new shim database where the file is located in a non-default location
Matching passage: Sigma rule: Detects the installation of a new shim database where the file is located in a non-default location. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Shim Database In Uncommon Location id: 6b6976a3-b0e6-4723-ac24-ae38a737af41 status: test description: Detects the installation of a new shim database where the file is located in a non-default location references: - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/ - https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-01 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.011 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\ - \DatabasePath filter_main_known_locations: Details|contains: :\Windows\AppPatch\Custom condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may. Logsource: windows / process_creation. Rule: title: Changing Existing Service ImagePath Value Via Reg.EXE id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db status: test description: 'Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe author: frack113 date: 2021-12-30 modified: 2024-03-13 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - 'add ' - SYSTEM\CurrentControlSet\Services\ - ' ImagePath ' selection_value: CommandLine|contains|windash: ' -d ' condition: all of selection* falsepositives: - Unknown level: medium
Query: write Sigma for Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con
Matching passage: Sigma rule: Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con. Logsource: windows / process_creation. Rule: title: Setup16.EXE Execution With Custom .Lst File id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e status: test description: 'Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility. ' references: - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ author: frack113 date: 2024-12-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: ParentImage: C:\Windows\SysWOW64\setup16.exe ParentCommandLine|contains: ' -m ' filter_optional_valid_path: Image|startswith: C:\~MSSETUP.T\ condition: selection and not 1 of filter_optional_* falsepositives: - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare. level: medium
Near-miss passage: Sigma rule: Detects attempts to enable the guest account using the sysadminctl utility. Logsource: macos / process_creation. Rule: title: Guest Account Enabled Via Sysadminctl id: d7329412-13bd-44ba-a072-3387f804a106 status: test description: Detects attempts to enable the guest account using the sysadminctl utility references: - https://ss64.com/osx/sysadminctl.html author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 - attack.t1078.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /sysadminctl CommandLine|contains|all: - ' -guestAccount' - ' on' condition: selection falsepositives: - Unknown level: low
Query: Multiple failed authentications followed by Services File Permissions Weakness
Matching passage: T1574.010 Services File Permissions Weakness. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.
Near-miss passage: T1574.009 Path Interception by Unquoted Path. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide) This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
Query: describe CVE-2015-5012
Matching passage: CVE-2015-5012. CWE: CWE-310. CVSS: 7.5. The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Near-miss passage: CVE-2015-3903. CWE: CWE-310. CVSS: 4.300000190734863. libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: vulnerability: fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-201
Matching passage: CVE-2015-1134. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1135.
Near-miss passage: CVE-2015-6104. CWE: CWE-20. CVSS: 9.300000190734863. The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-6103.
Query: risk of The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
Matching passage: CVE-2015-6240. CWE: CWE-59. CVSS: 7.800000190734863. The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
Near-miss passage: CVE-2015-7724. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
Query: ATT&CK technique for Cloud Groups
Matching passage: T1069.003 Cloud Groups. Tactics: discovery. Description: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command <code>az ad user get-member-groups</code> will list groups associated to a user account for Azure while the API endpoint <code>GET https://cloudidentity.googleapis.com/v1/groups</code> lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
Near-miss passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Query: Sigma rule for Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API an
Matching passage: Sigma rule: Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API an. Logsource: windows / process_creation. Rule: title: Disabling Windows Defender WMI Autologger Session via Reg.exe id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6 related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the ''Start'' value to ''0'' for the ''DefenderApiLogger'' or ''DefenderAuditLogger'' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique. ' references: - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/ - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions author: Matt Anderson (Huntress) date: 2025-07-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_path: CommandLine|contains: - \Control\WMI\Autologger\DefenderApiLogger\Start - \Control\WMI\Autologger\DefenderAuditLogger\Start selection_reg_add: CommandLine|contains|all: - add - '0' filter_main_enable: CommandLine|contains: '0x00000001' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Highly unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential. Logsource: windows / process_creation. Rule: title: Remote XSL Execution Via Msxsl.EXE id: 75d0a94e-6252-448d-a7be-d953dff527bb status: test description: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe CommandLine|contains: http condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: high