alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects when a Azure Kubernetes Cluster is created or deleted.
Matching passage: Sigma rule: Detects when a Azure Kubernetes Cluster is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Cluster Created or Deleted id: 9541f321-7cba-4b43-80fc-fbd1fb922808 status: test description: Detects when a Azure Kubernetes Cluster is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/DELETE condition: selection falsepositives: - Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.. Logsource: macos / file_event. Rule: title: MacOS Emond Launch Daemon id: 23c43900-e732-45a4-8354-63e4a6c187ce status: test description: Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md - https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 author: Alejandro Ortuno, oscd.community date: 2020-10-23 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.014 logsource: category: file_event product: macos detection: selection_1: TargetFilename|contains: /etc/emond.d/rules/ TargetFilename|endswith: .plist selection_2: TargetFilename|contains: /private/var/db/emondClients/ condition: 1 of selection_* falsepositives: - Legitimate administration activities level: medium
Query: Sigma rule for Detects service principal name (SPN) enumeration used for Kerberoasting
Matching passage: Sigma rule: Detects service principal name (SPN) enumeration used for Kerberoasting. Logsource: windows / process_creation. Rule: title: Potential SPN Enumeration Via Setspn.EXE id: 1eeed653-dbc8-4187-ad0c-eeebb20e6599 status: test description: Detects service principal name (SPN) enumeration used for Kerberoasting references: - https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation - https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019 author: Markus Neis, keepwatch date: 2018-11-14 modified: 2023-10-23 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: \setspn.exe - OriginalFileName: setspn.exe - Description|contains|all: - Query or reset the computer - SPN attribute selection_cli: CommandLine|contains: - ' -q ' - ' /q ' condition: all of selection_* falsepositives: - Administration activity level: medium
Near-miss passage: Sigma rule: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.. Logsource: proxy. Rule: title: Potential Base64 Encoded User-Agent id: 894a8613-cf12-48b3-8e57-9085f54aa0c3 related: - id: d443095b-a221-4957-a2c4-cd1756c9b747 type: derived status: test description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding. references: - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop author: Florian Roth (Nextron Systems), Brian Ingram (update) date: 2022-07-08 modified: 2023-05-04 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|endswith: '=' condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-3258
Matching passage: CVE-2015-3258. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job.
Near-miss passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Query: vulnerability: Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
Matching passage: CVE-2015-8107. CWE: CWE-134. CVSS: 7.800000190734863. Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-2894. CWE: CWE-134. CVSS: 5.300000190734863. Format string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and 7.2 allows remote attackers to cause a denial of service (application crash) via format string specifiers.
Query: exploit The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Matching passage: CVE-2015-9304. CWE: CWE-79. CVSS: 6.099999904632568. The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Near-miss passage: CVE-2015-2198. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.
Query: CVE similar to CVE-2015-8567
Matching passage: CVE-2015-8567. CWE: CWE-401. CVSS: 7.699999809265137. Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
Near-miss passage: CVE-2015-5080. CWE: CWE-77. CVSS: 9.0. The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs.
Query: write Sigma for Detects a service installed by a client which has PID 0 or whose parent has PID 0
Matching passage: Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / security. Rule: title: Service Installed By Unusual Client - Security id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca related: - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html - https://www.x86matthew.com/view_post?id=create_svc_rpc - https://twitter.com/SBousseaden/status/1490608838701166596 author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: service: security product: windows definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection_eid: EventID: 4697 selection_pid: - ClientProcessId: 0 - ParentProcessId: 0 condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati. Logsource: windows / file_delete. Rule: title: Backup Files Deleted id: 06125661-3814-4e03-bfa2-1e4411c60ac3 status: test description: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files author: frack113 date: 2022-01-02 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: product: windows category: file_delete detection: selection: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wt.exe - \rundll32.exe - \regsvr32.exe TargetFilename|endswith: - .VHD - .bac - .bak - .wbcat - .bkf - .set - .win - .dsk condition: selection falsepositives: - Legitimate usage level: medium
Query: Sigma rule for Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Matching passage: Sigma rule: Detects BGP failures which may be indicative of brute force attacks to manipulate routing. Logsource: cisco / bgp. Rule: title: Cisco BGP Authentication Failures id: 56fa3cd6-f8d6-4520-a8c7-607292971886 status: test description: Detects BGP failures which may be indicative of brute force attacks to manipulate routing references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: cisco service: bgp definition: 'Requirements: cisco bgp logs need to be enabled and ingested' detection: keywords_bgp_cisco: '|all': - :179 - IP-TCP-3-BADAUTH condition: keywords_bgp_cisco falsepositives: - Unlikely. Except due to misconfigurations level: low
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface. Logsource: windows / process_creation. Rule: title: UAC Bypass via ICMLuaUtil id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130 status: test description: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface references: - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html author: Florian Roth (Nextron Systems), Elastic (idea) date: 2022-09-13 modified: 2022-09-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dllhost.exe ParentCommandLine|contains: - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} filter: - Image|endswith: \WerFault.exe - OriginalFileName: WerFault.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: describe CVE-2015-8994
Matching passage: CVE-2015-8994. CWE: CWE-264. CVSS: 7.5. An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.
Near-miss passage: CVE-2015-5222. CWE: CWE-264. CVSS: 8.5. Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
Query: describe CVE-2015-9357
Matching passage: CVE-2015-9357. CWE: CWE-79. CVSS: 6.099999904632568. The akismet plugin before 3.1.5 for WordPress has XSS.
Near-miss passage: CVE-2015-7363. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in digital television/digital radio DRM.
Matching passage: CVE-2015-8595. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in digital television/digital radio DRM.
Near-miss passage: CVE-2015-7008. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: CVE similar to CVE-2015-1865
Matching passage: CVE-2015-1865. CWE: CWE-362. CVSS: 5.099999904632568. fts.c in coreutils 8.4 allows local users to delete arbitrary files.
Near-miss passage: CVE-2015-9022. CWE: CWE-362. CVSS: 7.0. In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs.
Query: exploit The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruptio
Matching passage: CVE-2015-7174. CWE: CWE-119. CVSS: 7.5. The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Near-miss passage: CVE-2015-9136. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, in pre-auth request, Host driver uses FT IEs sent by the supplicant. A buffer overflow may occur if FT IEs sent by the supplicant are larger than the expected value.
Query: Lateral movement indicators for Internet Connection Discovery
Matching passage: T1016.001 Internet Connection Discovery. Tactics: discovery. Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
Near-miss passage: T1016 System Network Configuration Discovery. Tactics: discovery. Description: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024) Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Query: patch priority for CVE-2015-5860
Matching passage: CVE-2015-5860. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Near-miss passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Query: detect Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic W in logs
Matching passage: Sigma rule: Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic W. Logsource: windows / registry_set. Rule: title: Registry Hide Function from User id: 5a93eb65-dffa-4543-b761-94aa60098fb6 status: test description: Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideClock - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCANetwork - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAPower - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAVolume Details: DWORD (0x00000001) selection_set_0: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor Details: DWORD (0x00000000) condition: 1 of selection_set_* falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: PowerShell Console History Logs Deleted id: ff301988-c231-4bd0-834c-ac9d73b86586 status: test description: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|endswith: \PSReadLine\ConsoleHost_history.txt condition: selection falsepositives: - Unknown level: medium
Query: Sigma rule for Detects suspicious service installation commands
Matching passage: Sigma rule: Detects suspicious service installation commands. Logsource: windows / system. Rule: title: Suspicious Service Installation id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 26481afe-db26-4228-b264-25a29fe6efc7 type: similar status: test description: Detects suspicious service installation commands references: - Internal Research author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2023-12-04 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - ' -nop ' - ' -sta ' - ' -w hidden ' - :\Temp\ - .downloadfile( - .downloadstring( - \ADMIN$\ - \Perflogs\ - '&&' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects new user account creation. Logsource: okta / okta. Rule: title: New Okta User Created id: b6c718dd-8f53-4b9f-98d8-93fdca966969 status: test description: Detects new user account creation author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 modified: 2026-04-27 references: - https://developer.okta.com/docs/reference/api/event-types/ tags: - attack.credential-access logsource: service: okta product: okta detection: selection: eventType: user.lifecycle.create condition: selection falsepositives: - Legitimate and authorized user creation level: informational