alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common a
Matching passage: Sigma rule: Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common a. Logsource: windows / file_event. Rule: title: Suspicious File Creation In Uncommon AppData Folder id: d7b50671-d1ad-4871-aa60-5aa5b331fe04 status: test description: Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-02-23 tags: - attack.execution - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\ TargetFilename|endswith: - .bat - .cmd - .cpl - .dll - .exe - .hta - .iso - .lnk - .msi - .ps1 - .psm1 - .scr - .vbe - .vbs filter_main: TargetFilename|startswith: C:\Users\ TargetFilename|contains: - \AppData\Local\ - \AppData\LocalLow\ - \AppData\Roaming\ condition: selection and not filter_main falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious powershell command line parameters used in Empire. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell Launch Parameters id: 79f4ede3-402e-41c8-bc3e-ebbf5f162581 status: test description: Detects suspicious powershell command line parameters used in Empire references: - https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 author: Florian Roth (Nextron Systems) date: 2019-04-20 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -sta -NonI -W Hidden -Enc ' - ' -noP -sta -w 1 -enc ' - ' -NoP -NonI -W Hidden -enc ' - ' -noP -sta -w 1 -enc' - ' -enc SQB' - ' -nop -exec bypass -EncodedCommand ' condition: selection falsepositives: - Other tools that incidentally use the same command line parameters level: high
Query: containment actions for Encoded PowerShell / command-line abuse matching GUI Input Capture
Matching passage: Playbook for T1056.002 GUI Input Capture. 1) Validate alert telemetry against T1056.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection, credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](h
Near-miss passage: Playbook for T1056 Input Capture. Different response path focused on collection, credential access.
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.
Matching passage: CVE-2015-9068. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.
Near-miss passage: CVE-2015-6164. CWE: CWE-20. CVSS: 6.800000190734863. Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, aka "Internet Explorer XSS Filter Bypass Vulnerability."
Query: Sigma rule for Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Matching passage: Sigma rule: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.. Logsource: linux / process_creation. Rule: title: Potential Linux Amazon SSM Agent Hijacking id: f9b3edc5-3322-4fc7-8aa3-245d646cc4b7 status: test description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report. references: - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/ - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/ author: Muhammad Faisal date: 2023-08-03 tags: - attack.command-and-control - attack.persistence - attack.t1219.002 logsource: category: process_creation product: linux detection: selection: Image|endswith: /amazon-ssm-agent CommandLine|contains|all: - '-register ' - '-code ' - '-id ' - '-region ' condition: selection falsepositives: - Legitimate activity of system administrators level: medium
Near-miss passage: Sigma rule: Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions. Logsource: azure / auditlogs. Rule: title: App Granted Privileged Delegated Or App Permissions id: 5aecf3d5-f8a0-48e7-99be-3a759df7358f related: - id: ba2a7c80-027b-460f-92e2-57d113897dbc type: obsolete status: test description: Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 modified: 2023-03-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1098.003 logsource: product: azure service: auditlogs detection: selection: properties.message: Add app role assignment to service principal condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Query: rule covering Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution
Matching passage: Sigma rule: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. Logsource: windows / process_creation. Rule: title: Potential Manage-bde.wsf Abuse To Proxy Execution id: c363385c-f75d-4753-a108-c1a8e28bdbda status: test description: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution references: - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/ - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712 - https://twitter.com/bohops/status/980659399495741441 - https://twitter.com/JohnLaTwC/status/1223292479270600706 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2023-02-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_wscript_img: - Image|endswith: \wscript.exe - OriginalFileName: wscript.exe selection_wscript_cli: CommandLine|contains: manage-bde.wsf selection_parent: ParentImage|endswith: - \cscript.exe - \wscript.exe ParentCommandLine|contains: manage-bde.wsf selection_filter_cmd: Image|endswith: \cmd.exe condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd) falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and othe. Logsource: windows / process_creation. Rule: title: System Disk And Volume Reconnaissance Via Wmic.EXE id: c79da740-5030-45ec-a2e0-479e824a562c related: - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e type: similar status: test description: 'An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the ''wmic'' command-line utility and has been observed being used by threat actors such as Volt Typhoon. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: Stephen Lincoln '@slincoln-aiq' (AttackIQ) date: 2024-02-02 modified: 2025-10-20 tags: - attack.execution - attack.discovery - attack.t1047 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: - CommandLine|contains: - ' volumename' - ' logicaldisk' - CommandLine|contains|all: - path - win32_logicaldisk - CommandLine|contains|all: - ' volume' - ' list ' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_volume/info.yml
Query: write Sigma for Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Matching passage: Sigma rule: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.. Logsource: azure / auditlogs. Rule: title: New Root Certificate Authority Added id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e status: test description: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication. references: - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ author: Harjot Shah Singh, '@cyb3rjy0t' date: 2024-03-26 tags: - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: OperationName: Set Company Information TargetResources.modifiedProperties.newValue|contains: TrustedCAsForPasswordlessAuth condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.. Logsource: windows / process_creation. Rule: title: Suspicious Execution Location Of Wermgr.EXE id: 5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5 related: - id: 396f6630-f3ac-44e3-bfc8-1b161bc00c4e type: similar status: test description: Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location. references: - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - https://www.echotrail.io/insights/search/wermgr.exe - https://github.com/binderlabs/DirCreate2System author: Florian Roth (Nextron Systems) date: 2022-10-14 modified: 2023-08-23 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: \wermgr.exe filter_main_legit_location: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: vulnerability: mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
Matching passage: CVE-2015-5700. CWE: CWE-59. CVSS: 6.099999904632568. mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
Near-miss passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Query: describe CVE-2015-7658
Matching passage: CVE-2015-7658. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionInstanceOf arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-8424. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: adversary uses Cloud Account
Matching passage: T1136.003 Cloud Account. Tactics: persistence. Description: Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment.(Citation: Microsoft Entra ID Service Principals) In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005).(Citation: GCP Service Accounts) While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.(Citation: AWS Instance Profiles)(Citation: AWS Lambda Execution Role) Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection. Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Near-miss passage: T1136 Create Account. Tactics: persistence. Description: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Query: risk of The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-
Matching passage: CVE-2015-5868. CWE: CWE-119. CVSS: 7.199999809265137. The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5896 and CVE-2015-5903.
Near-miss passage: CVE-2015-9070. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall.
Query: risk of The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot tim
Matching passage: CVE-2015-6547. CWE: CWE-77. CVSS: 8.300000190734863. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
Near-miss passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of the IEExec utility to download and execute files. Logsource: windows / process_creation. Rule: title: File Download And Execution Via IEExec.EXE id: 9801abb8-e297-4dbf-9fbd-57dde0e830ad status: test description: Detects execution of the IEExec utility to download and execute files references: - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IEExec.exe - OriginalFileName: IEExec.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet). Logsource: windows / process_creation. Rule: title: Suspicious Encoded PowerShell Command Line id: ca2092a1-c273-4878-9b4b-0d60115bf5ea status: test description: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) references: - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community date: 2018-09-03 modified: 2023-04-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_content: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aQBlAHgA' - ' aWV4I' - ' IAA' - ' IAB' - ' UwB' - ' cwB' selection_standalone: CommandLine|contains: - '.exe -ENCOD ' - ' BA^J e-' filter_optional_remote_signed: CommandLine|contains: ' -ExecutionPolicy remotesigned ' condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_* level: high
Query: rule covering Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
Matching passage: Sigma rule: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Execution id: 48bbc537-b652-4b4e-bd1d-281172df448f related: - id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 type: similar status: test description: Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.privilege-escalation - attack.discovery - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class. Logsource: windows / image_load. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load id: f354eba5-623b-450f-b073-0b5b2773b6aa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: image_load detection: selection: Image|endswith: \Internet Explorer\iexplore.exe ImageLoaded|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical