alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.
Matching passage: Sigma rule: Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.. Logsource: windows / file_event. Rule: title: LiveKD Kernel Memory Dump File Created id: 814ddeca-3d31-4265-8e07-8cc54fb44903 status: test description: Detects the creation of a file that has the same name as the default LiveKD kernel memory dump. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 tags: - attack.privilege-escalation - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\livekd.dmp condition: selection falsepositives: - In rare occasions administrators might leverage LiveKD to perform live kernel debugging. This should not be allowed on production systems. Investigate and apply additional filters where necessary. level: high
Near-miss passage: Sigma rule: Detects service installation of different remote access tools software. These software are often abused by threat actors. Logsource: windows / security. Rule: title: Remote Access Tool Services Have Been Installed - Security id: c8b00925-926c-47e3-beea-298fd563728e related: - id: 1a31b18a-f00c-4061-9900-f735b96c99fc type: similar status: test description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform references: - https://redcanary.com/blog/misbehaving-rats/ author: Connor Martin, Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 modified: 2024-12-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceName|contains: - AmmyyAdmin - AnyDesk - Atera - BASupportExpressSrvcUpdater - BASupportExpressStandaloneService - chromoting - GoToAssist - GoToMyPC - jumpcloud - LMIGuardianSvc - LogMeIn - monblanking - Parsec - RManService - RPCPerformanceService - RPCService - SplashtopRemoteService - SSUService - TeamViewer - TightVNC - vncserver - Zoho condition: selection falsepositives: - The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out level: medium
Query: CWE for Not Using Complete Mediation
Matching passage: CWE-638 Not Using Complete Mediation. The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
Near-miss passage: CWE-415 Double Free. The product calls free() twice on the same memory address.
Query: CVE similar to CVE-2015-10004
Matching passage: CVE-2015-10004. CWE: CWE-668. CVSS: 7.5. Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
Near-miss passage: CVE-2015-7278. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack the authentication of arbitrary users.
Query: exploit The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.
Matching passage: CVE-2015-4286. CWE: CWE-20. CVSS: 5.0. The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.
Near-miss passage: CVE-2015-6242. CWE: CWE-20. CVSS: 4.300000190734863. The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size, which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet.
Query: CVE similar to CVE-2015-5827
Matching passage: CVE-2015-5827. CWE: CWE-200. CVSS: 5.0. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
Near-miss passage: CVE-2015-3690. CWE: CWE-200. CVSS: 4.300000190734863. The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: exploit Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867.
Matching passage: CVE-2015-5646. CWE: CWE-94. CVSS: 8.5. Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-863 and CyVDB-867.
Near-miss passage: CVE-2015-5721. CWE: CWE-94. CVSS: 9.800000190734863. Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Query: detect Detection use of the command "split" to split files into parts and possible transfer. in logs
Matching passage: Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: macos / process_creation. Rule: title: Split A File Into Pieces id: 7f2bb9d5-6395-4de5-969c-70c11fbe6b12 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-15 modified: 2021-11-27 tags: - attack.exfiltration - attack.t1030 logsource: product: macos category: process_creation detection: selection: Image|endswith: /split condition: selection falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.. Logsource: juniper / bgp. Rule: title: Juniper BGP Missing MD5 id: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 status: test description: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing. references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: juniper service: bgp definition: 'Requirements: juniper bgp logs need to be enabled and ingested' detection: keywords_bgp_juniper: '|all': - :179 - missing MD5 digest condition: keywords_bgp_juniper falsepositives: - Unlikely. Except due to misconfigurations level: low
Query: ATT&CK technique for Develop Capabilities
Matching passage: T1587 Develop Capabilities. Tactics: resource development. Description: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.
Near-miss passage: T1587.003 Digital Certificates. Tactics: resource development. Description: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
Query: CVE similar to CVE-2015-1822
Matching passage: CVE-2015-1822. CWE: CWE-17. CVSS: 6.5. chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
Near-miss passage: CVE-2015-6760. CWE: CWE-17. CVSS: 7.5. The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-lost events, which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.
Query: alert when Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi
Matching passage: Sigma rule: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi. Logsource: windows / registry_set. Rule: title: Enable Local Manifest Installation With Winget id: fa277e82-9b78-42dd-b05c-05555c7b6015 status: test description: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles Details: DWORD (0x00000001) condition: selection falsepositives: - Administrators or developers might enable this for testing purposes or to install custom private packages level: medium
Near-miss passage: Sigma rule: Detects processes creating temp files related to PCRE.NET package. Logsource: windows / file_event. Rule: title: PCRE.NET Package Temp Files id: 6e90ae7a-7cd3-473f-a035-4ebb72d961da status: test description: Detects processes creating temp files related to PCRE.NET package references: - https://twitter.com/rbmaslen/status/1321859647091970051 - https://twitter.com/tifkin_/status/1321916444557365248 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-29 modified: 2022-10-09 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\ condition: selection falsepositives: - Unknown level: high
Query: rule covering Detects driver load of the System Informer tool
Matching passage: Sigma rule: Detects driver load of the System Informer tool. Logsource: windows / driver_load. Rule: title: PUA - System Informer Driver Load id: 10cb6535-b31d-4512-9962-513dcbc42cc1 related: - id: 67add051-9ee7-4ad3-93ba-42935615ae8d type: similar status: test description: Detects driver load of the System Informer tool references: - https://systeminformer.sourceforge.io/ - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|endswith: \SystemInformer.sys - Hashes|contains: - SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24 - SHA256=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454 - SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D - SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B - SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D - SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34 - SHA256=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89 - SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB - SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B - SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97 - SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656 - SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4 - SHA256=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects a tscon.exe start as LOCAL SYSTEM. Logsource: windows / process_creation. Rule: title: Suspicious TSCON Start as SYSTEM id: 9847f263-4a81-424f-970c-875dab15b79b status: test description: Detects a tscon.exe start as LOCAL SYSTEM references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2022-05-27 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: User|contains: - AUTHORI - AUTORI Image|endswith: \tscon.exe condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects enumeration of local network configuration
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder. Logsource: windows / process_creation. Rule: title: Execution of Powershell Script in Public Folder id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4 status: test description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder references: - https://www.mandiant.com/resources/evolution-of-fin7 author: Max Altgelt (Nextron Systems) date: 2022-04-06 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - -f C:\Users\Public - -f "C:\Users\Public - -f %Public% - -fi C:\Users\Public - -fi "C:\Users\Public - -fi %Public% - -fil C:\Users\Public - -fil "C:\Users\Public - -fil %Public% - -file C:\Users\Public - -file "C:\Users\Public - -file %Public% condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory co
Matching passage: CVE-2015-4489. CWE: CWE-119. CVSS: 7.5. The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.
Near-miss passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Query: alert when Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential maliciou
Matching passage: Sigma rule: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential maliciou. Logsource: windows / file_event. Rule: title: Suspicious Binaries and Scripts in Public Folder id: b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e status: experimental description: Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity. references: - https://intel.thedfirreport.com/events/view/30032 - https://intel.thedfirreport.com/eventReports/view/70 - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ author: The DFIR Report date: 2025-01-23 tags: - attack.execution - attack.t1204 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: :\Users\Public\ TargetFilename|endswith: - .bat - .dll - .exe - .hta - .js - .ps1 - .vbe - .vbs condition: selection falsepositives: - Administrators deploying legitimate binaries to public folders. level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_public_folder_extension/info.yml
Near-miss passage: Sigma rule: Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be. Logsource: windows / file_access. Rule: title: Access To Windows DPAPI Master Keys By Uncommon Applications id: 46612ae6-86be-4802-bc07-39b59feb1309 status: test description: 'Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function ' references: - http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/ - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 modified: 2026-07-28 tags: - attack.credential-access - attack.t1555.004 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|contains: - \Microsoft\Protect\S-1-5-18\ - \Microsoft\Protect\S-1-5-21- filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: alert when Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Matching passage: Sigma rule: Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.. Logsource: windows / application. Rule: title: MSSQL XPCmdshell Option Change id: d08dd86f-681e-4a00-a92c-1db218754417 status: test description: 'Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. ' references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-06-26 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name|contains: MSSQL EventID: 15457 Data|contains: xp_cmdshell condition: selection falsepositives: - Legitimate enable/disable of the setting - Note that since the event contain the change for both values. This means that this will trigger on both enable and disable level: high
Near-miss passage: Sigma rule: Detects the use of smbexec.py tool by detecting a specific service installation. Logsource: windows / system. Rule: title: smbexec.py Service Installation id: 52a85084-6989-40c3-8f32-091e12e13f09 status: test description: Detects the use of smbexec.py tool by detecting a specific service installation references: - https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/ - https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296 - https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60 author: Omer Faruk Celik date: 2018-03-20 modified: 2023-11-09 tags: - attack.lateral-movement - attack.execution - attack.t1021.002 - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service_name: ServiceName: BTOBTO selection_service_image: ImagePath|contains: - '.bat & del ' - __output 2^>^&1 > condition: selection_eid and 1 of selection_service_* falsepositives: - Unknown level: high