alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for f. Logsource: windows / file_event. Rule: title: Suspicious Executable File Creation id: 74babdd6-a758-4549-9632-26535279e654 status: test description: 'Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths. ' references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/ author: frack113 date: 2022-09-05 modified: 2023-12-11 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\$Recycle.Bin.exe - :\Documents and Settings.exe - :\MSOCache.exe - :\PerfLogs.exe - :\Recovery.exe - .bat.exe - .sys.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords. Logsource: windows / registry_set. Rule: title: Potential Ransomware Activity Using LegalNotice Message id: 8b9606c9-28be-4a38-b146-0e313cc232c1 status: test description: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md author: frack113 date: 2022-12-11 modified: 2023-08-17 tags: - attack.impact - attack.t1491.001 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText Details|contains: - encrypted - Unlock-Password - paying condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
Matching passage: CVE-2015-5612. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
Near-miss passage: CVE-2015-6942. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.
Query: detect Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth. in logs
Matching passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via SQLAuth id: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.. Logsource: windows / ps_script. Rule: title: PowerShell Script With File Upload Capabilities id: d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb status: test description: Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md - https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4 author: frack113 date: 2022-01-07 modified: 2025-07-18 tags: - attack.exfiltration - attack.t1020 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_cmdlet: ScriptBlockText|contains: - Invoke-RestMethod - Invoke-WebRequest - 'irm ' - 'iwr ' selection_flag: ScriptBlockText|contains: - -Method "POST" - -Method "PUT" - -Method POST - -Method PUT - -Method 'POST' - -Method 'PUT' condition: all of selection_* falsepositives: - Unknown level: low
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects files that have extensions commonly seen while SDelete is used to wipe files.. Logsource: windows / security. Rule: title: Potential Secure Deletion with SDelete id: 39a80702-d7ca-4a83-b776-525b1f86a36d status: test description: Detects files that have extensions commonly seen while SDelete is used to wipe files. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete author: Thomas Patzke date: 2017-06-14 modified: 2024-12-13 tags: - attack.impact - attack.stealth - attack.defense-impairment - attack.t1070.004 - attack.t1027.005 - attack.t1485 - attack.t1553.002 - attack.s0195 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 - 4658 ObjectName|endswith: - .AAA - .ZZZ condition: selection falsepositives: - Legitimate usage of SDelete - Files that are interacted with that have these extensions legitimately level: medium
Near-miss passage: Sigma rule: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud. Logsource: windows / process_creation. Rule: title: Node Process Executions id: df1f26d3-bea7-4700-9ea2-ad3e990cf90e status: test description: Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud references: - https://twitter.com/mttaggart/status/1511804863293784064 author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.execution - attack.stealth - attack.t1127 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Adobe Creative Cloud Experience\libs\node.exe filter: CommandLine|contains: Adobe Creative Cloud Experience\js condition: selection and not filter falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-9387
Matching passage: CVE-2015-9387. CWE: CWE-352. CVSS: 6.5. The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
Near-miss passage: CVE-2015-4010. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
Query: patch priority for CVE-2015-8748
Matching passage: CVE-2015-8748. CWE: CWE-264. CVSS: 5.300000190734863. Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
Near-miss passage: CVE-2015-4045. CWE: CWE-264. CVSS: 6.699999809265137. The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script.
Query: patch priority for CVE-2015-8604
Matching passage: CVE-2015-8604. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
Near-miss passage: CVE-2015-5617. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
Query: alert when Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, un
Matching passage: Sigma rule: Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, un. Logsource: linux / process_creation. Rule: title: Shell Execution via Flock - Linux id: 4b09c71e-4269-4111-9cdd-107d8867f0cc status: test description: 'Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/flock/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /flock CommandLine|contains: ' -u ' selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious interactive bash as a parent to rather uncommon child processes. Logsource: linux / process_creation. Rule: title: Interactive Bash Suspicious Children id: ea3ecad2-db86-4a89-ad0b-132a10d2db55 status: test description: Detects suspicious interactive bash as a parent to rather uncommon child processes references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-14 tags: - attack.execution - attack.stealth - attack.t1059.004 - attack.t1036 logsource: product: linux category: process_creation detection: selection: ParentCommandLine: bash -i anomaly1: CommandLine|contains: - '-c import ' - base64 - pty.spawn anomaly2: Image|endswith: - whoami - iptables - /ncat - /nc - /netcat condition: selection and 1 of anomaly* falsepositives: - Legitimate software that uses these patterns level: medium
Query: describe CVE-2015-5580
Matching passage: CVE-2015-5580. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
Near-miss passage: CVE-2015-1902. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSMLA.
Query: detect Detects usage of winget to add new additional download sources in logs
Matching passage: Sigma rule: Detects usage of winget to add new additional download sources. Logsource: windows / process_creation. Rule: title: Add New Download Source To Winget id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 related: - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar - id: c15a46a0-07d4-4c87-b4b6-89207835a83b type: similar status: test description: Detects usage of winget to add new additional download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' condition: all of selection_* falsepositives: - False positive are expected with legitimate sources level: medium
Near-miss passage: Sigma rule: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific ser. Logsource: windows / security. Rule: title: Metasploit Or Impacket Service Installation Via SMB PsExec id: 6fb63b40-e02a-403e-9ffd-3bcc1d749442 related: - id: 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0 type: derived status: test description: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation references: - https://bczyz1.github.io/2021/01/30/psexec.html author: Bartlomiej Czyz, Relativity date: 2021-01-21 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1570 - attack.execution - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|re: ^%systemroot%\\[a-zA-Z]{8}\.exe$ ServiceName|re: (^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$) ServiceStartType: 3 ServiceType: '0x10' filter: ServiceName: PSEXESVC condition: selection and not filter falsepositives: - Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name level: high
Query: containment actions for Lateral movement indicators for Path Interception by Unquoted Path
Matching passage: Playbook for T1574.009 Path Interception by Unquoted Path. 1) Validate alert telemetry against T1574.009. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also b
Near-miss passage: Playbook for T1574.001 DLL. Different response path focused on stealth, execution.
Query: patch priority for CVE-2015-9006
Matching passage: CVE-2015-9006. CWE: CWE-284. CVSS: 7.800000190734863. In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.
Near-miss passage: CVE-2015-8973. CWE: CWE-284. CVSS: 8.300000190734863. xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Query: mitigate Office Test
Matching passage: T1137.002 Office Test. Tactics: persistence. Description: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy) There exist user and global Registry keys for the Office Test feature, such as: * <code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code> Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Near-miss passage: T1137.001 Office Template Macros. Tactics: persistence. Description: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template) Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019) Word Normal.dotm location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Templates\Normal.dotm</code> Excel Personal.xlsb location:<br> <code>C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB</code> Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under <code>C:\Program Files (x86)\Microsoft Office\root\Office16\</code>, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019) An adversary may need to enable macros to execute unrestricted depending
Query: describe CVE-2015-1951
Matching passage: CVE-2015-1951. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation.
Near-miss passage: CVE-2015-2884. CWE: CWE-200. CVSS: 7.5. Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi.
Query: indicators of Local Account
Matching passage: T1136.001 Local Account. Tactics: persistence. Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Near-miss passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: write Sigma for Detects commandline operations on shell history files
Matching passage: Sigma rule: Detects commandline operations on shell history files. Logsource: linux / auditd. Rule: title: Suspicious History File Operations - Linux id: eae8ce9f-bde9-47a6-8e79-f20d18419910 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2022-11-28 tags: - attack.credential-access - attack.t1552.003 logsource: product: linux service: auditd detection: execve: type: EXECVE history: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: execve and history falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Near-miss passage: Sigma rule: Identifies when a service principal was removed in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Service Principal Removed id: 448fd1ea-2116-4c62-9cde-a92d120e0f08 status: test description: Identifies when a service principal was removed in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/keeping-track-of-object-deletions-in-microsoft-entra-id/4053415 author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: Remove service principal condition: selection falsepositives: - Service principal being removed may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: exploit Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions
Matching passage: CVE-2015-2534. CWE: CWE-284. CVSS: 1.899999976158142. Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions via a crafted application, aka "Hyper-V Security Feature Bypass Vulnerability."
Near-miss passage: CVE-2015-4034. CWE: CWE-284. CVSS: 7.900000095367432. The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object.