alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects when an attempt at deactivating or resetting MFA.
Matching passage: Sigma rule: Detects when an attempt at deactivating or resetting MFA.. Logsource: okta / okta. Rule: title: Okta MFA Reset or Deactivated id: 50e068d7-1e6b-4054-87e5-0a592c40c7e0 status: test description: Detects when an attempt at deactivating or resetting MFA. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-21 modified: 2026-04-27 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.006 logsource: product: okta service: okta detection: selection: eventType: - user.mfa.factor.deactivate - user.mfa.factor.reset_all condition: selection falsepositives: - If a MFA reset or deactivated was performed by a system administrator. level: medium
Near-miss passage: Sigma rule: Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attacke. Logsource: windows / file_event. Rule: title: Publisher Attachment File Dropped In Suspicious Location id: 3d2a2d59-929c-4b78-8c1a-145dfe9e07b1 status: test description: Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attackers abusing Publisher documents references: - https://twitter.com/EmericNasi/status/1623224526220804098 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - C:\Temp\ TargetFilename|endswith: .pub condition: selection falsepositives: - Legitimate usage of ".pub" files from those locations level: medium
Query: alert when Identifies when a device in azure is no longer managed or compliant
Matching passage: Sigma rule: Identifies when a device in azure is no longer managed or compliant. Logsource: azure / auditlogs. Rule: title: Azure Device No Longer Managed or Compliant id: 542b9912-c01f-4e3f-89a8-014c48cdca7d status: test description: Identifies when a device in azure is no longer managed or compliant references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.impact logsource: product: azure service: auditlogs detection: selection: operationName: - Device no longer compliant - Device no longer managed condition: selection falsepositives: - Administrator may have forgotten to review the device. level: medium
Near-miss passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via ITaskSchedulerService id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e status: test description: Detects remote RPC calls to read information about scheduled tasks references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c filter: OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection and not filter falsepositives: - Unknown level: high
Query: risk of The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
Matching passage: CVE-2015-1857. CWE: CWE-200. CVSS: 5.300000190734863. The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
Near-miss passage: CVE-2015-3391. CWE: CWE-200. CVSS: 5.0. The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive node titles by reading a 403 Not Found page.
Query: CVE similar to CVE-2015-6702
Matching passage: CVE-2015-6702. CWE: CWE-772. CVSS: 4.300000190734863. The createSquareMesh function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6703, and CVE-2015-6704.
Near-miss passage: CVE-2015-6697. CWE: CWE-772. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to obtain sensitive information about color objects from process memory by reading a light object's RGB data, a different vulnerability than CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Query: actor TTPs: Social Media
Matching passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Near-miss passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: detection rule: Detects the creation of binaries in the WinSxS folder by non-system processes
Matching passage: Sigma rule: Detects the creation of binaries in the WinSxS folder by non-system processes. Logsource: windows / file_event. Rule: title: WinSxS Executable File Creation By Non-System Process id: 34746e8c-5fb8-415a-b135-0abc167e912a related: - id: 64827580-e4c3-4c64-97eb-c72325d45399 type: derived status: test description: Detects the creation of binaries in the WinSxS folder by non-system processes references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-11 tags: - attack.execution logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\WinSxS\ TargetFilename|endswith: .exe filter_main_system_location: Image|startswith: - C:\Windows\Systems32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of Rundll32.exe with DLL files masquerading as image files. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Execution With Image Extension id: 4aa6040b-3f28-44e3-a769-9208e5feb5ec related: - id: 089fc3d2-71e8-4763-a8a5-c97fbb0a403e type: similar status: test description: Detects the execution of Rundll32.exe with DLL files masquerading as image files references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.exe selection_cli: CommandLine|contains: - .bmp - .cr2 - .eps - .gif - .ico - .jpeg - .jpg - .nef - .orf - .png - .raw - .sr2 - .tif - .tiff condition: all of selection_* falsepositives: - Unknown level: high
Query: EDR alert: possible WHOIS (T1596.002)
Matching passage: T1596.002 WHOIS. Tactics: reconnaissance. Description: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS) Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596 Search Open Technical Databases. Tactics: reconnaissance. Description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan) Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: CVE similar to CVE-2015-2487
Matching passage: CVE-2015-2487. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499.
Near-miss passage: CVE-2015-5773. CWE: CWE-119. CVSS: 6.800000190734863. QL Office in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted office document.
Query: Sigma rule for Detects remote RPC calls to modify the registry and possible execute code
Matching passage: Sigma rule: Detects remote RPC calls to modify the registry and possible execute code. Logsource: rpc_firewall / application. Rule: title: Remote Registry Lateral Movement id: 35c55673-84ca-4e99-8d09-e334f3c29539 status: test description: Detects remote RPC calls to modify the registry and possible execute code references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement - attack.defense-impairment - attack.t1112 - attack.persistence logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003 OpNum: - 6 - 7 - 8 - 13 - 18 - 19 - 21 - 22 - 23 - 35 condition: selection falsepositives: - Remote administration of registry values level: high
Near-miss passage: Sigma rule: Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundl. Logsource: windows / file_event. Rule: title: HackTool - NetExec File Indicators id: efc21479-9e83-41da-8cf1-122e06ba8db3 status: experimental description: 'Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution. ' references: - https://github.com/Pennyw0rth/NetExec - https://www.netexec.wiki/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-08 tags: - attack.execution - attack.lateral-movement - attack.discovery - attack.t1021.002 - attack.t1059.005 logsource: product: windows category: file_event detection: selection: - Image|contains: \nxc-windows-latest\ - TargetFilename|contains|all: - \Temp\_MEI - \nxc\data\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml
Query: vulnerability: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading
Matching passage: CVE-2015-0143. CWE: CWE-200. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
Near-miss passage: CVE-2015-4295. CWE: CWE-200. CVSS: 4.0. The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.5(3.10000.9) allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819.
Query: detect Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to in logs
Matching passage: Sigma rule: Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to. Logsource: aws / cloudtrail. Rule: title: AWS S3 Bucket Versioning Disable id: a136ac98-b2bc-4189-a14d-f0d0388e57a7 status: test description: Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects. references: - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82 author: Sean Johnstone | Unit 42 date: 2023-10-28 tags: - attack.impact - attack.t1490 logsource: product: aws service: cloudtrail detection: selection: eventSource: s3.amazonaws.com eventName: PutBucketVersioning requestParameters|contains: Suspended condition: selection falsepositives: - AWS administrator legitimately disabling bucket versioning level: medium
Near-miss passage: Sigma rule: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Logsource: windows / registry_set. Rule: title: Disable Microsoft Defender Firewall via Registry id: 974515da-6cc5-4c95-ae65-f97f9150ec7f status: test description: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry author: frack113 date: 2022-01-09 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\SharedAccess\Parameters\FirewallPolicy\ TargetObject|endswith: \EnableFirewall Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/info.yml simulation: - type: atomic-red-team name: Disable Microsoft Defender Firewall via Registry technique: T1562.004 atomic_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612
Query: rule covering Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or unde
Matching passage: Sigma rule: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or unde. Logsource: windows / process_creation. Rule: title: Suspicious Double Extension File Execution id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 related: - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c type: similar status: stable description: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns references: - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html - https://twitter.com/blackorbird/status/1140519090961825792 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) date: 2019-06-26 modified: 2025-05-30 tags: - attack.initial-access - attack.t1566.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe CommandLine|contains: - ' .exe' - ______.exe - .doc.exe - .doc.js - .docx.exe - .docx.js - .gif.exe - .jpeg.exe - .jpg.exe - .mkv.exe - .mov.exe - .mp3.exe - .mp4.exe - .pdf.exe - .pdf.js - .png.exe - .ppt.exe - .ppt.js - .pptx.exe - .pptx.js - .rtf.exe - .rtf.js - .svg.exe - .txt.exe - .txt.js - .xls.exe - .xls.js - .xlsx.exe - .xlsx.js - ⠀⠀⠀⠀⠀⠀.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module id: a136cde0-61ad-4a61-9b82-8dc490e60dd2 related: - id: 73e67340-0d25-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4103 falsepositives: - Unknown level: high