alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScript
Matching passage: Sigma rule: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScript. Logsource: windows / image_load. Rule: title: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load id: b439f47d-ef52-4b29-9a2f-57d8a96cb6b8 status: test description: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity. references: - https://twitter.com/HunterPlaybook/status/1301207718355759107 - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/ - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-09-02 modified: 2023-02-22 tags: - attack.lateral-movement - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \scrcons.exe ImageLoaded|endswith: - \vbscript.dll - \wbemdisp.dll - \wshom.ocx - \scrrun.dll condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium
Near-miss passage: Sigma rule: Identifies when a DNS Zone is modified or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud DNS Zone Modified or Deleted id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3 status: test description: Identifies when a DNS Zone is modified or deleted in Google Cloud. references: - https://cloud.google.com/dns/docs/reference/v1/managedZones author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - Dns.ManagedZones.Delete - Dns.ManagedZones.Update - Dns.ManagedZones.Patch condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a d
Matching passage: CVE-2015-0972. CWE: CWE-255. CVSS: 5.0. Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password.
Near-miss passage: CVE-2015-6095. CWE: CWE-255. CVSS: 4.900000095367432. Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles password changes, which allows physically proximate attackers to bypass authentication, and conduct decryption attacks against certain BitLocker configurations, by connecting to an unintended Key Distribution Center (KDC), aka "Windows Kerberos Security Feature Bypass."
Query: SOC alert related to Clear Persistence
Matching passage: T1070.009 Clear Persistence. Tactics: stealth. Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Near-miss passage: T1070 Indicator Removal. Tactics: stealth. Description: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Query: describe CVE-2015-2479
Matching passage: CVE-2015-2479. CWE: CWE-264. CVSS: 9.300000190734863. The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2480 and CVE-2015-2481.
Near-miss passage: CVE-2015-7964. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: containment actions for Persistence mechanism resembling Domain or Tenant Policy Modification
Matching passage: Playbook for T1484 Domain or Tenant Policy Modification. 1) Validate alert telemetry against T1484. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or ide
Near-miss passage: Playbook for T1484.002 Trust Modification. Different response path focused on defense impairment, privilege escalation.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: Anydesk Temporary Artefact id: 0b9ad457-2554-44c1-82c2-d56a99c42377 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows author: frack113 date: 2022-02-11 modified: 2024-07-20 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Roaming\AnyDesk\user.conf - \AppData\Roaming\AnyDesk\system.conf condition: selection falsepositives: - Legitimate use level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
Near-miss passage: Sigma rule: Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backe. Logsource: linux / process_creation. Rule: title: Process Execution From Shared Memory Directory id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4 status: experimental description: 'Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection. ' references: - https://www.sysdig.com/blog/containers-read-only-fileless-malware - https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7 - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ author: Stan Beukers date: 2026-06-20 tags: - attack.stealth - attack.execution - attack.t1027.011 logsource: category: process_creation product: linux detection: selection: Image|startswith: /dev/shm/ condition: selection falsepositives: - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables. level: high
Query: exploit Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified dom
Matching passage: CVE-2015-2751. CWE: CWE-17. CVSS: 7.099999904632568. Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.
Near-miss passage: CVE-2015-1465. CWE: CWE-17. CVSS: 7.800000190734863. The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.
Query: Sigma rule for Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
Matching passage: Sigma rule: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.. Logsource: windows / registry_set. Rule: title: Potential WerFault ReflectDebugger Registry Value Abuse id: 0cf2e1c6-8d10-4273-8059-738778f981ad related: - id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd type: derived status: test description: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence. references: - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/ author: X__Junior date: 2023-05-18 tags: - attack.stealth - attack.t1036.003 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or fir. Logsource: windows / process_creation. Rule: title: PUA - Fast Reverse Proxy (FRP) Execution id: 32410e29-5f94-4568-b6a3-d91a8adad863 status: test description: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet. references: - https://asec.ahnlab.com/en/38156/ - https://github.com/fatedier/frp author: frack113, Florian Roth date: 2022-09-02 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \frpc.exe - \frps.exe selection_cli: CommandLine|contains: \frpc.ini selection_hashes: Hashes|contains: - MD5=7D9C233B8C9E3F0EA290D2B84593C842 - SHA1=06DDC9280E1F1810677935A2477012960905942F - SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C condition: 1 of selection_* falsepositives: - Legitimate use level: high
Query: SOC alert related to Content Injection
Matching passage: T1659 Content Injection. Tactics: initial access, command and control. Description: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer) Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment) (Citation: Kaspersky Encyclopedia MiTM) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server (Citation: Kaspersky ManOnTheSide) Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack)
Near-miss passage: T1090.004 Domain Fronting. Tactics: command and control. Description: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Query: CVE similar to CVE-2015-5271
Matching passage: CVE-2015-5271. CWE: CWE-200. CVSS: 7.5. The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
Near-miss passage: CVE-2015-5070. CWE: CWE-200. CVSS: 3.0999999046325684. The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Query: rule covering Detects the execution of "hh.exe" to open ".chm" files.
Matching passage: Sigma rule: Detects the execution of "hh.exe" to open ".chm" files.. Logsource: windows / process_creation. Rule: title: HH.EXE Execution id: 68c8acb4-1b60-4890-8e82-3ddf7a6dba84 status: test description: Detects the execution of "hh.exe" to open ".chm" files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md - https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community date: 2019-10-24 modified: 2023-12-11 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: .chm condition: all of selection_* falsepositives: - False positives are expected with legitimate ".CHM" level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hh_chm_execution/info.yml
Near-miss passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting t. Logsource: windows / registry_set. Rule: title: Windows Recall Feature Enabled - Registry id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium
Query: mitigate Protocol Tunneling
Matching passage: T1572 Protocol Tunneling. Tactics: command and control. Description: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)(Citation: Sygnia Abyss Locker 2025) [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19) Adversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure.
Near-miss passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Query: SOC runbook when seeing Lateral movement indicators for Pass the Hash
Matching passage: Playbook for T1550.002 Pass the Hash. 1) Validate alert telemetry against T1550.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: lateral movement. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication
Near-miss passage: Playbook for T1550.004 Web Session Cookie. Different response path focused on lateral movement.
Query: vulnerability: JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can
Matching passage: CVE-2015-20110. CWE: CWE-307. CVSS: 7.5. JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
Near-miss passage: CVE-2015-2221. CWE: CWE-399. CVSS: 5.0. ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.