alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress
Matching passage: Sigma rule: Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress. Logsource: windows / process_creation. Rule: title: Compressed File Creation Via Tar.EXE id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9 status: test description: 'Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. ' references: - https://unit42.paloaltonetworks.com/chromeloader-malware/ - https://lolbas-project.github.io/lolbas/Binaries/Tar/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage author: Nasreddine Bencherchali (Nextron Systems), AdmU3 date: 2023-12-19 tags: - attack.collection - attack.exfiltration - attack.t1560 - attack.t1560.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tar.exe - OriginalFileName: bsdtar selection_create: CommandLine|contains: - -c - -r - -u condition: all of selection_* falsepositives: - Likely level: low
Near-miss passage: Sigma rule: Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ra. Logsource: windows / process_creation. Rule: title: Fsutil Suspicious Invocation id: add64136-62e5-48ea-807e-88638d02df1e status: stable description: 'Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others). ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md - https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt author: Ecco, E.M. Anhaus, oscd.community date: 2019-09-26 modified: 2023-09-09 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: - deletejournal - createjournal - setZeroData condition: all of selection_* falsepositives: - Admin activity - Scripts and administrative tools used in the monitored environment level: high
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to injec
Matching passage: CVE-2015-8758. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Near-miss passage: CVE-2015-0766. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196.
Query: describe CVE-2015-1306
Matching passage: CVE-2015-1306. CWE: CWE-200. CVSS: 5.0. The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-2556. CWE: CWE-200. CVSS: 4.300000190734863. The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "Microsoft SharePoint Information Disclosure Vulnerability."
Query: vulnerability: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
Matching passage: CVE-2015-2485. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2491 and CVE-2015-2541.
Near-miss passage: CVE-2015-5283. CWE: CWE-119. CVSS: 4.699999809265137. The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.
Query: detect Detects when a Container Registry is created or deleted. in logs
Matching passage: Sigma rule: Detects when a Container Registry is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Container Registry Created or Deleted id: 93e0ef48-37c8-49ed-a02c-038aab23628e status: test description: Detects when a Container Registry is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE condition: selection falsepositives: - Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files. Logsource: windows / registry_event. Rule: title: Potential Qakbot Registry Activity id: 1c8e96cd-2bed-487d-9de0-b46c90cade56 status: test description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Software\firm\soft\Name condition: selection falsepositives: - Unknown level: high
Query: alert when Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes a
Matching passage: Sigma rule: Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes a. Logsource: linux / process_creation. Rule: title: User Has Been Deleted Via Userdel id: 08f26069-6f80-474b-8d1f-d971c6fedea0 status: test description: Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks references: - https://linuxize.com/post/how-to-delete-group-in-linux/ - https://www.cyberciti.biz/faq/linux-remove-user-command/ - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/ - https://linux.die.net/man/8/userdel author: Tuan Le (NCSGroup) date: 2022-12-26 tags: - attack.impact - attack.t1531 logsource: product: linux category: process_creation detection: selection: Image|endswith: /userdel condition: selection falsepositives: - Legitimate administrator activities level: medium
Near-miss passage: Sigma rule: Detects when multi-factor authentication (MFA) is disabled.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace MFA Disabled id: 780601d1-6376-4f2a-884e-b8d45599f78c status: test description: Detects when multi-factor authentication (MFA) is disabled. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION author: Austin Songer date: 2021-08-26 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection_base: eventService: admin.googleapis.com eventName: - ENFORCE_STRONG_AUTHENTICATION - ALLOW_STRONG_AUTHENTICATION selection_eventValue: new_value: 'false' condition: all of selection* falsepositives: - MFA may be disabled and performed by a system administrator. level: medium
Query: rule covering Detects PsExec service installation and execution events
Matching passage: Sigma rule: Detects PsExec service installation and execution events. Logsource: windows / system. Rule: title: PsExec Service Installation id: 42c575ea-e41e-41f1-b248-8093c3e82a28 status: test description: Detects PsExec service installation and execution events references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2023-08-04 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: PSEXESVC - ImagePath|endswith: \PSEXESVC.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script. Logsource: windows / process_creation. Rule: title: HackTool - Wmiexec Default Powershell Command id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0 status: test description: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script references: - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-08 tags: - attack.lateral-movement - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.. Logsource: windows / process_creation. Rule: title: Suspicious Mstsc.EXE Execution With Local RDP File id: 6e22722b-dfb1-4508-a911-49ac840b40f8 status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations. references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_extension: CommandLine|endswith: - .rdp - .rdp" selection_paths: CommandLine|contains: - :\Users\Public\ - :\Windows\System32\spool\drivers\color - ':\Windows\System32\Tasks_Migrated ' - :\Windows\Tasks\ - :\Windows\Temp\ - :\Windows\Tracing\ - \AppData\Local\Temp\ - \Downloads\ condition: all of selection_* falsepositives: - Likelihood is related to how often the paths are used in the environment level: high
Near-miss passage: Sigma rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via Cdb.EXE id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2 status: test description: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/ - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html - https://twitter.com/nas_bench/status/1534957360032120833 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1218 - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cdb.exe - OriginalFileName: CDB.Exe selection_cli: CommandLine|contains: - ' -c ' - ' -cf ' condition: all of selection* falsepositives: - Legitimate use of debugging tools level: medium
Query: patch priority for CVE-2015-1180
Matching passage: CVE-2015-1180. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
Near-miss passage: CVE-2015-9104. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Query: describe CVE-2015-4207
Matching passage: CVE-2015-4207. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by visiting a meeting-registration page, aka Bug ID CSCus62147.
Near-miss passage: CVE-2015-0271. CWE: CWE-200. CVSS: 4.0. The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration.
Matching passage: CVE-2015-0575. CWE: CWE-326. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration.
Near-miss passage: CVE-2015-5361. CWE: CWE-326. CVSS: 6.5. Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and server. The design intent of the ftps-extensions option (which is disabled by default) is to provide similar functionality when the SRX secures the FTP/FTPS client. As the control channel is encrypted, the FTP ALG cannot inspect the port specific information and will open a wider TCP data channel (gate) from client IP to server IP on all destination TCP ports. In FTP/FTPS client environments to an enterprise network or the Internet, this is the desired behavior as it allows firewall policy to be written to FTP/FTPS servers on well-known control ports without using a policy with destination IP ANY and destination port ANY. Issue The ftps-extensions option is not intended or recommended where the SRX secures the FTPS server, as the wide data channel session (gate) will allow the FTPS client temporary access to all TCP ports on the FTPS server. The data session is associated to the control channel and will be closed when the control channel session closes. Depending on the configuration of the FTPS server, supporting load-balancer, and SRX inactivity-timeout values, the server/load-balancer and SRX may keep the control channel open for an extended period of time, allowing an FTPS client access for an equal duration.​ Note that the ftps-extensions option is not enabled by default.
Query: write Sigma for Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explore
Matching passage: Sigma rule: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explore. Logsource: windows / security. Rule: title: Windows Network Access Suspicious desktop.ini Action id: 35bc7e28-ee6b-492f-ab04-da58fcf6402e status: test description: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk. references: - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/ author: Tim Shelton (HAWK.IO) date: 2021-12-06 modified: 2022-01-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows service: security detection: selection: EventID: 5145 ObjectType: File RelativeTargetName|endswith: \desktop.ini AccessList|contains: - WriteData - DELETE - WriteDAC - AppendData - AddSubdirectory condition: selection falsepositives: - Read only access list authority level: medium
Near-miss passage: Sigma rule: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.. Logsource: windows / iis-configuration. Rule: title: ETW Logging/Processing Option Disabled On IIS Server id: a5b40a90-baf5-4bf7-a6f7-373494881d22 status: test description: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/ author: frack113, Nasreddine Bencherchali date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration|endswith: '@logTargetW3C' OldValue|contains: ETW filter_main_etw_added: NewValue|contains: ETW condition: selection and not 1 of filter_main_* falsepositives: - Legitimate administrator activity level: medium
Query: rule covering Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati
Matching passage: Sigma rule: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati. Logsource: windows / file_delete. Rule: title: Backup Files Deleted id: 06125661-3814-4e03-bfa2-1e4411c60ac3 status: test description: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files author: frack113 date: 2022-01-02 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: product: windows category: file_delete detection: selection: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wt.exe - \rundll32.exe - \regsvr32.exe TargetFilename|endswith: - .VHD - .bac - .bak - .wbcat - .bkf - .set - .win - .dsk condition: selection falsepositives: - Legitimate usage level: medium
Near-miss passage: Sigma rule: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. Logsource: windows / process_creation. Rule: title: New Port Forwarding Rule Added Via Netsh.EXE id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614 status: test description: Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - https://adepts.of0x.cc/netsh-portproxy-code/ - https://www.dfirnotes.net/portproxy_detection/ author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel date: 2019-01-29 modified: 2023-09-01 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli_1: CommandLine|contains|all: - interface - portproxy - add - v4tov4 selection_cli_2: CommandLine|contains|all: - 'i ' - 'p ' - 'a ' - 'v ' selection_cli_3: CommandLine|contains|all: - connectp - listena - c= condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate administration activity - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723) level: medium
Query: risk of The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a c
Matching passage: CVE-2015-5163. CWE: CWE-200. CVSS: 3.5. The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
Near-miss passage: CVE-2015-6135. CWE: CWE-200. CVSS: 5.0. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-3040
Matching passage: CVE-2015-3040. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-0357.
Near-miss passage: CVE-2015-8095. CWE: CWE-200. CVSS: 5.0. The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.