alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent loc
Matching passage: Sigma rule: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent loc. Logsource: azure / riskdetection. Rule: title: New Country id: adf9f4d2-559e-4f5c-95be-c28dff0b1476 status: test description: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: newCountry condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects when an Okta user session starts where the user is behind an anonymising proxy service.. Logsource: okta / okta. Rule: title: Okta User Session Start Via An Anonymising Proxy Service id: bde30855-5c53-4c18-ae90-1ff79ebc9578 status: test description: Detects when an Okta user session starts where the user is behind an anonymising proxy service. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: okta service: okta detection: selection: eventType: user.session.start securityContext.isProxy: 'true' condition: selection falsepositives: - If a user requires an anonymising proxy due to valid justifications. level: high
Query: alert when Detects suspicious network connections made by a well-known Windows binary run with no command line parameters
Matching passage: Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Octopus Scanner Malware.. Logsource: windows / file_event. Rule: title: Octopus Scanner Malware id: 805c55d9-31e6-4846-9878-c34c75054fe9 status: test description: Detects Octopus Scanner Malware. references: - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain author: NVISO date: 2020-06-09 modified: 2021-11-27 tags: - attack.initial-access - attack.t1195 - attack.t1195.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \AppData\Local\Microsoft\Cache134.dat - \AppData\Local\Microsoft\ExplorerSync.db condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1692
Matching passage: CVE-2015-1692. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5730. CWE: CWE-200. CVSS: 5.0. The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Query: rule covering Detects suspicious IIS native-code module installations via command line
Matching passage: Sigma rule: Detects suspicious IIS native-code module installations via command line. Logsource: windows / process_creation. Rule: title: IIS Native-Code Module Command Line Installation id: 9465ddf4-f9e4-4ebd-8d98-702df3a93239 status: test description: Detects suspicious IIS native-code module installations via command line references: - https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems) date: 2019-12-11 modified: 2024-03-13 tags: - attack.persistence - attack.t1505.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - install - module CommandLine|contains|windash: '-name:' filter_iis_setup: ParentImage: C:\Windows\System32\inetsrv\iissetup.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown as it may vary from organisation to organisation how admins use to install IIS modules level: medium
Near-miss passage: Sigma rule: Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundl. Logsource: windows / file_event. Rule: title: HackTool - NetExec File Indicators id: efc21479-9e83-41da-8cf1-122e06ba8db3 status: experimental description: 'Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution. ' references: - https://github.com/Pennyw0rth/NetExec - https://www.netexec.wiki/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-08 tags: - attack.execution - attack.lateral-movement - attack.discovery - attack.t1021.002 - attack.t1059.005 logsource: product: windows category: file_event detection: selection: - Image|contains: \nxc-windows-latest\ - TargetFilename|contains|all: - \Temp\_MEI - \nxc\data\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml
Query: alert when Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos
Matching passage: Sigma rule: Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Enumeration id: 53821412-17b0-4147-ade0-14faae67d54b status: test description: 'Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: status condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity. Logsource: windows / process_creation. Rule: title: Suspicious Kerberos Ticket Request via CLI id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 related: - id: a861d835-af37-4930-bcd6-5b178bfb54df type: similar status: experimental description: 'Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. ' references: - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_cli: CommandLine|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: all of selection_* falsepositives: - Legitimate command line usage by administrators or security tools. level: high
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Startup Folder id: 0e20c89d-2264-44ae-8238-aeeaba609ece status: test description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence. references: - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-02 modified: 2023-06-22 tags: - attack.persistence - attack.t1137 logsource: category: file_event product: windows detection: selection_word_paths: - TargetFilename|contains: \Microsoft\Word\STARTUP - TargetFilename|contains|all: - \Office - \Program Files - \STARTUP selection_word_extension: TargetFilename|endswith: - .doc - .docm - .docx - .dot - .dotm - .rtf selection_excel_paths: - TargetFilename|contains: \Microsoft\Excel\XLSTART - TargetFilename|contains|all: - \Office - \Program Files - \XLSTART selection_excel_extension: TargetFilename|endswith: - .xls - .xlsm - .xlsx - .xlt - .xltm filter_main_office: Image|endswith: - \WINWORD.exe - \EXCEL.exe condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office falsepositives: - Loading a user environment from a backup or a domain controller - Synchronization of templates level: high
Near-miss passage: Sigma rule: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might ind. Logsource: windows / process_creation. Rule: title: Persistence Via TypedPaths - CommandLine id: ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba status: test description: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt references: - https://twitter.com/dez_/status/1560101453150257154 - https://forensafe.com/blogs/typedpaths.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 tags: - attack.persistence logsource: category: process_creation product: windows detection: selection: CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-3055
Matching passage: CVE-2015-3055. CWE: CWE-416. CVSS: 7.5. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3054, CVE-2015-3059, and CVE-2015-3075.
Near-miss passage: CVE-2015-4448. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, and CVE-2015-5114.
Query: detection rule: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be
Matching passage: Sigma rule: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be. Logsource: windows / registry_set. Rule: title: Potential Persistence Via MyComputer Registry Keys id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06 status: test description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example) references: - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2024-01-11 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer TargetObject|endswith: (Default) condition: selection falsepositives: - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for level: high
Near-miss passage: Sigma rule: Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exf. Logsource: linux / network_connection. Rule: title: Communication To Ngrok Tunneling Service - Linux id: 19bf6fdb-7721-4f3d-867f-53467f6a5db6 status: test description: Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors references: - https://twitter.com/hakluke/status/1587733971814977537/photo/1 - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent author: Florian Roth (Nextron Systems) date: 2022-11-03 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1568.002 - attack.t1572 - attack.t1090 - attack.t1102 - attack.s0508 logsource: product: linux category: network_connection detection: selection: DestinationHostname|contains: - tunnel.us.ngrok.com - tunnel.eu.ngrok.com - tunnel.ap.ngrok.com - tunnel.au.ngrok.com - tunnel.sa.ngrok.com - tunnel.jp.ngrok.com - tunnel.in.ngrok.com condition: selection falsepositives: - Legitimate use of ngrok level: high
Query: alert when Detects service installation of different remote access tools software. These software are often abused by threat actors
Matching passage: Sigma rule: Detects service installation of different remote access tools software. These software are often abused by threat actors. Logsource: windows / system. Rule: title: Remote Access Tool Services Have Been Installed - System id: 1a31b18a-f00c-4061-9900-f735b96c99fc related: - id: c8b00925-926c-47e3-beea-298fd563728e type: similar status: test description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform references: - https://redcanary.com/blog/misbehaving-rats/ author: Connor Martin, Nasreddine Bencherchali date: 2022-12-23 modified: 2023-06-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: - 7045 - 7036 ServiceName|contains: - AmmyyAdmin - Atera - BASupportExpressSrvcUpdater - BASupportExpressStandaloneService - chromoting - GoToAssist - GoToMyPC - jumpcloud - LMIGuardianSvc - LogMeIn - monblanking - Parsec - RManService - RPCPerformanceService - RPCService - SplashtopRemoteService - SSUService - TeamViewer - TightVNC - vncserver - Zoho condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects activity when Windows Defender Firewall has been reset to its default configuration. Logsource: windows / firewall-as. Rule: title: Windows Defender Firewall Has Been Reset To Its Default Configuration id: 04b60639-39c0-412a-9fbe-e82499c881a3 status: test description: Detects activity when Windows Defender Firewall has been reset to its default configuration references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2023-04-21 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2032 - 2060 condition: selection level: low
Query: CVE similar to CVE-2015-2411
Matching passage: CVE-2015-2411. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2389.
Near-miss passage: CVE-2015-9206. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, during XML encoding of a message in the Playready module, a buffer overread may occur if the message passed is large.
Query: campaign using Commonly Used Port
Matching passage: T1043 Commonly Used Port. Tactics: command and control. Description: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.** Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as * TCP:80 (HTTP) * TCP:443 (HTTPS) * TCP:25 (SMTP) * TCP/UDP:53 (DNS) They may use the protocol associated with the port or a completely different protocol. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are * TCP/UDP:135 (RPC) * TCP/UDP:22 (SSH) * TCP/UDP:3389 (RDP)
Near-miss passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Query: patch priority for CVE-2015-3308
Matching passage: CVE-2015-3308. CWE: UNKNOWN. CVSS: 7.5. Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
Near-miss passage: CVE-2015-4749. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
Query: adversary uses Local Accounts
Matching passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Near-miss passage: T1078.001 Default Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes) Default accounts are not limited to client machines; rather, they also include accounts that are preset for equipment such as network devices and computer applications, whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module) Default accounts may be created on a system after initial setup by connecting or integrating it with another application. For example, when an ESXi server is connected to a vCenter server, a default privileged account called `vpxuser` is created on the ESXi server. If a threat actor is able to compromise this account’s credentials (for example, via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212) on the vCenter host), they will then have access to the ESXi server.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)(Citation: Pentera vCenter Information Disclosure)