alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
Matching passage: Sigma rule: Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Firewall Modified or Deleted id: fe513c69-734c-4d4a-8548-ac5f609be82b status: test description: Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP). references: - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html author: Austin Songer @austinsonger date: 2021-08-13 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - v*.Compute.Firewalls.Delete - v*.Compute.Firewalls.Patch - v*.Compute.Firewalls.Update - v*.Compute.Firewalls.Insert condition: selection falsepositives: - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected. - Exceptions can be added to this rule to filter expected behavior. level: medium
Near-miss passage: Sigma rule: Detects attempts of decoding encoded Gzip archives via PowerShell.. Logsource: windows / process_creation. Rule: title: Gzip Archive Decode Via PowerShell id: 98767d61-b2e8-4d71-b661-e36783ee24c1 status: test description: Detects attempts of decoding encoded Gzip archives via PowerShell. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: Hieu Tran date: 2023-03-13 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - GZipStream - ::Decompress condition: selection falsepositives: - Legitimate administrative scripts may use this functionality. Use "ParentImage" in combination with the script names and allowed users and applications to filter legitimate executions level: medium
Query: telemetry for T1499.001
Matching passage: T1499.001 OS Exhaustion Flood. Tactics: impact. Description: Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes. Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.(Citation: Arbor AnnualDoSreport Jan 2018) With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.(Citation: Cloudflare SynFlood) ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.(Citation: Corero SYN-ACKflood)
Near-miss passage: T1499.004 Application or System Exploitation. Tactics: impact. Description: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Query: risk of Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to prope
Matching passage: CVE-2015-3656. CWE: CWE-285. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.
Near-miss passage: CVE-2015-7463. CWE: CWE-285. CVSS: 4.300000190734863. IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393.
Query: describe CVE-2015-6319
Matching passage: CVE-2015-6319. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.
Near-miss passage: CVE-2015-1367. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
Query: CVE similar to CVE-2015-7318
Matching passage: CVE-2015-7318. CWE: CWE-20. CVSS: 7.5. Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
Near-miss passage: CVE-2015-1139. CWE: CWE-20. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .sgi file.
Query: patch priority for CVE-2015-4848
Matching passage: CVE-2015-4848. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Integration with Peoplesoft.
Near-miss passage: CVE-2015-2115. CWE: UNKNOWN. CVSS: 2.700000047683716. Unspecified vulnerability in HP Capture and Route Software (HPCR) 1.3 before Patch 7, 1.3 FP1 before Patch 1, and 1.4 before Patch 1 allows remote authenticated users to obtain sensitive information via unknown vectors.
Query: vulnerability: The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Matching passage: CVE-2015-9312. CWE: CWE-79. CVSS: 6.099999904632568. The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Near-miss passage: CVE-2015-6518. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) droptable parameter, or (3) table parameter to phpliteadmin.php.
Query: rule covering Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Matching passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - new-object - text.encoding]::ascii ScriptBlockText|contains: - system.io.compression.deflatestream - system.io.streamreader ScriptBlockText|endswith: readtoend condition: selection_4104 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order t. Logsource: windows / security. Rule: title: Important Scheduled Task Deleted/Disabled id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-03-13 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection: EventID: - 4699 - 4701 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\Schedule - \Windows\ExploitGuard filter_main_defender_update: EventID: 4699 SubjectUserName|endswith: $ TaskName|contains: \Windows\Windows Defender\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Query: detection rule: Detects disabling of the Windows Defender virus scanning feature
Matching passage: Sigma rule: Detects disabling of the Windows Defender virus scanning feature. Logsource: windows / windefend. Rule: title: Windows Defender Virus Scanning Feature Disabled id: 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: Detects disabling of the Windows Defender virus scanning feature references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5012 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro. Logsource: windows / network_connection. Rule: title: Communication To LocaltoNet Tunneling Service Initiated id: 3ab65069-d82a-4d44-a759-466661a082d1 status: test description: 'Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls. ' references: - https://localtonet.com/documents/supported-tunnels - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications author: Andreas Braathen (mnemonic.io) date: 2024-06-17 tags: - attack.command-and-control - attack.t1572 - attack.t1090 - attack.t1102 logsource: category: network_connection product: windows detection: selection: DestinationHostname|endswith: - .localto.net - .localtonet.com Initiated: 'true' condition: selection falsepositives: - Legitimate use of the LocaltoNet service. level: high
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
Matching passage: CVE-2015-0405. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
Near-miss passage: CVE-2015-7653. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted globalToLocal arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Query: telemetry for T1069
Matching passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: alert when Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encry
Matching passage: Sigma rule: Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encry. Logsource: windows / security. Rule: title: Potential AS-REP Roasting via Kerberos TGT Requests id: 3e2f1b2c-4d5e-11ee-be56-0242ac120002 status: experimental description: 'Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC. This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords. ' references: - https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714 - https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004 author: ANosir date: 2025-05-22 modified: 2025-07-04 logsource: product: windows service: security detection: selection: EventID: 4768 TicketEncryptionType: '0x17' ServiceName: krbtgt PreAuthType: 0 condition: selection falsepositives: - Legacy systems or applications that legitimately use RC4 encryption - Misconfigured accounts with pre-authentication disabled level: medium
Near-miss passage: Sigma rule: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location. Logsource: windows / image_load. Rule: title: Microsoft Excel Add-In Loaded From Uncommon Location id: af4c4609-5755-42fe-8075-4effb49f5d44 related: - id: c5f4b5cb-4c25-4249-ba91-aa03626e3185 type: derived status: test description: Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location references: - https://www.mandiant.com/resources/blog/lnk-between-browsers - https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-12 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \excel.exe ImageLoaded|contains: - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ - \Windows\Tasks\ ImageLoaded|endswith: .xll condition: selection falsepositives: - Some tuning might be required to allow or remove certain locations used by the rule if you consider them as safe locations level: medium
Query: Sigma rule for Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such a
Matching passage: Sigma rule: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such a. Logsource: windows / process_creation. Rule: title: Computer System Reconnaissance Via Wmic.EXE id: 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f status: test description: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-08 modified: 2023-02-14 tags: - attack.discovery - attack.execution - attack.t1047 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: computersystem condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem/info.yml
Near-miss passage: Sigma rule: Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.. Logsource: windows / process_creation. Rule: title: HackTool - RemoteKrbRelay Execution id: a7664b14-75fb-4a50-a223-cb9bc0afbacf status: test description: 'Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata. ' references: - https://github.com/CICADA8-Research/RemoteKrbRelay author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-27 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \RemoteKrbRelay.exe - OriginalFileName: RemoteKrbRelay.exe selection_cli_required: CommandLine|contains|all: - ' -clsid ' - ' -target ' - ' -victim ' selection_cli_attack_smb: CommandLine|contains|all: - '-smb ' - '--smbkeyword ' CommandLine|contains: - interactive - secrets - service-add selection_cli_attack_rbcd_main: CommandLine|contains: '-rbcd ' selection_cli_attack_rbcd_options: CommandLine|contains: - '-cn ' - '--computername ' selection_cli_attack_changepass: CommandLine|contains: '-chp ' CommandLine|contains|all: - '-chpPass ' - '-chpUser ' selection_cli_attack_addgrpname: CommandLine|contains|all: - '-addgroupmember ' - '-group ' - '-groupuser ' condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb falsepositives: - Unlikely level: high
Query: Sigma rule for A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co
Matching passage: Sigma rule: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard co. Logsource: windows / ps_module. Rule: title: PowerShell Get Clipboard id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78 status: test description: A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/16 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2023-01-04 tags: - attack.collection - attack.t1115 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains: Get-Clipboard condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / process_creation. Rule: title: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 related: - id: 71ff406e-b633-4989-96ec-bc49d825a412 type: similar - id: daf7eb81-35fd-410d-9d7a-657837e602bb type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2022-10-09 tags: - attack.collection - attack.t1074.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium