alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: threat report mentioning Cloud Account
Matching passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / process_creation. Rule: title: AADInternals PowerShell Cmdlets Execution - ProccessCreation id: c86500e9-a645-4680-98d7-f882c70c1ea3 related: - id: 91e69562-2426-42ce-a647-711b8152ced6 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_cli: CommandLine|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: high
Near-miss passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / process_creation. Rule: title: Root Certificate Installed From Susp Locations id: 5f6a601c-2ecb-498b-9c33-660362323afa status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-01-16 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Import-Certificate - ' -FilePath ' - Cert:\LocalMachine\Root CommandLine|contains: - \AppData\Local\Temp\ - :\Windows\TEMP\ - \Desktop\ - \Downloads\ - \Perflogs\ - :\Users\Public\ condition: selection falsepositives: - Unlikely level: high
Query: alert when Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotif
Matching passage: Sigma rule: Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotif. Logsource: windows / registry_set. Rule: title: UAC Notification Disabled id: c5f6a85d-b647-40f7-bbad-c10b66bab038 related: - id: 0d7ceeef-3539-4392-8953-3dc664912714 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system''s operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md - https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Security Center\UACDisableNotify Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PowerShell calling a credential prompt. Logsource: windows / ps_script. Rule: title: PowerShell Credential Prompt id: ca8b77a9-d499-4095-b793-5d5f330d450e status: test description: Detects PowerShell calling a credential prompt references: - https://twitter.com/JohnLaTwC/status/850381440629981184 - https://t.co/ezOTGy1a1G author: John Lambert (idea), Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2022-12-25 tags: - attack.credential-access - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PromptForCredential condition: selection falsepositives: - Unknown level: high
Query: alert when Detects PowerShell creating a binary executable or a script file.
Matching passage: Sigma rule: Detects PowerShell creating a binary executable or a script file.. Logsource: windows / file_event. Rule: title: Potential Binary Or Script Dropper Via PowerShell id: 7047d730-036f-4f40-b9d8-1c63e36d5e62 status: test description: Detects PowerShell creating a binary executable or a script file. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-17 modified: 2025-07-04 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe TargetFilename|endswith: - .bat - .chm - .cmd - .com - .dll - .exe - .hta - .jar - .js - .ocx - .scr - .sys - .vbe - .vbs - .wsf filter_main_user_temp: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: - .dll - .exe filter_main_other_temp: TargetFilename|startswith: - C:\Windows\Temp\ - C:\Windows\SystemTemp\ TargetFilename|endswith: - .dll - .exe filter_main_powershell_module: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \WindowsPowerShell\Modules\ TargetFilename|endswith: .dll filter_main_nuget: TargetFilename|startswith: C:\Program Files\PackageManagement\ProviderAssemblies\nuget\ TargetFilename|endswith: \Microsoft.PackageManagement.NuGetProvider.dll condition: selection and not 1 of filter_main_* falsepositives: - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or r. Logsource: windows / process_creation. Rule: title: Potentially Suspicious NTFS Symlink Behavior Modification id: c0b2768a-dd06-4671-8339-b16ca8d1f27f status: test description: 'Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks. ' references: - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/ author: frack113, The DFIR Report date: 2022-03-02 modified: 2025-11-13 tags: - attack.execution - attack.defense-impairment - attack.t1059 - attack.t1222.001 logsource: category: process_creation product: windows detection: selection_img_proxy: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_fsutil_cli: CommandLine|contains|all: - fsutil - behavior - set - SymlinkEvaluation selection_symlink_params: CommandLine|contains: - R2L:1 - R2R:1 - L2L:1 condition: all of selection_* falsepositives: - Legitimate usage, investigate the parent process and context to determine if benign. level: medium
Query: exploit Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified com
Matching passage: CVE-2015-6426. CWE: CWE-20. CVSS: 7.199999809265137. Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427.
Near-miss passage: CVE-2015-2672. CWE: CWE-20. CVSS: 5.5. The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting, which allows local users to cause a denial of service (panic) by triggering a fault, as demonstrated by an unaligned memory operand or a non-canonical address memory operand.
Query: Sigma rule for Detects Obfuscated Powershell via VAR++ LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION id: e9f55347-2928-4c06-88e5-1a7f8169942e status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '&&set' - cmd - /c - -f CommandLine|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent. Logsource: proxy. Rule: title: Potential Hello-World Scraper Botnet Activity id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5 status: experimental description: 'Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string. ' references: - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 author: Joseph A. M. date: 2025-08-02 tags: - attack.reconnaissance - attack.t1595 logsource: category: proxy detection: selection: c-useragent: Hello-World/1.0 cs-method: GET condition: selection falsepositives: - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent. - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems. level: medium
Query: Sigma rule for Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy"
Matching passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy". Logsource: windows / ps_script. Rule: title: Change PowerShell Policies to an Insecure Level - PowerShell id: 61d0475c-173f-4844-86f7-f3eebae1c66b related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 author: frack113 date: 2021-10-20 modified: 2023-12-14 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: Set-ExecutionPolicy selection_option: ScriptBlockText|contains: - Unrestricted - bypass filter_optional_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1') - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Administrator script level: medium
Near-miss passage: Sigma rule: Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an att. Logsource: aws / cloudtrail. Rule: title: AWS Identity Center Identity Provider Change id: d3adb3ef-b7e7-4003-9092-1924c797db35 status: test description: 'Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation. ' references: - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html author: Michael McIntyre @wtfender date: 2023-09-27 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556 logsource: product: aws service: cloudtrail detection: selection: eventSource: - sso-directory.amazonaws.com - sso.amazonaws.com eventName: - AssociateDirectory - DisableExternalIdPConfigurationForDirectory - DisassociateDirectory - EnableExternalIdPConfigurationForDirectory condition: selection falsepositives: - Authorized changes to the AWS account's identity provider level: high
Query: risk of EMC RecoverPoint for Virtual Machines (VMs) 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface.
Matching passage: CVE-2015-4526. CWE: CWE-284. CVSS: 7.199999809265137. EMC RecoverPoint for Virtual Machines (VMs) 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface.
Near-miss passage: CVE-2015-3854. CWE: CWE-284. CVSS: 7.5. packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350.
Query: CVE similar to CVE-2015-2947
Matching passage: CVE-2015-2947. CWE: CWE-441. CVSS: 9.100000381469727. KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.
Near-miss passage: CVE-2015-10003. CWE: CWE-441. CVSS: 4.300000190734863. A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
Query: describe CVE-2015-3815
Matching passage: CVE-2015-3815. CWE: CWE-119. CVSS: 5.0. The detect_version function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not check the length of the payload, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a packet with a crafted payload, as demonstrated by a length of zero, a different vulnerability than CVE-2015-3906.
Near-miss passage: CVE-2015-3123. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Query: describe CVE-2015-5761
Matching passage: CVE-2015-5761. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5755.
Near-miss passage: CVE-2015-1789. CWE: CWE-119. CVSS: 7.5. The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.
Query: exploit Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differential cryptanalysis of a file with an o
Matching passage: CVE-2015-2987. CWE: CWE-17. CVSS: 2.5999999046325684. Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differential cryptanalysis of a file with an original length smaller than 128 bits.
Near-miss passage: CVE-2015-5912. CWE: CWE-17. CVSS: 5.0. The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses.
Query: detection engineering for Communication Through Removable Media
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: indicators of OS Credential Dumping
Matching passage: T1003 OS Credential Dumping. Tactics: credential access. Description: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Near-miss passage: T1003.003 NTDS. Tactics: credential access. Description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy