alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loa. Logsource: linux / auditd. Rule: title: Loading of Kernel Module via Insmod id: 106d7cbd-80ff-4985-b682-a7043e5acb72 status: test description: 'Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md - https://linux.die.net/man/8/insmod - https://man7.org/linux/man-pages/man8/kmod.8.html author: Pawel Mazur date: 2021-11-02 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.t1547.006 logsource: product: linux service: auditd detection: selection: type: SYSCALL comm: insmod exe: /usr/bin/kmod condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process. Logsource: windows / file_event. Rule: title: PowerShell Module File Created By Non-PowerShell Process id: e3845023-ca9a-4024-b2b2-5422156d5527 status: test description: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 modified: 2025-10-07 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \WindowsPowerShell\Modules\ - \PowerShell\7\Modules\ filter_main_pwsh: Image|endswith: - :\Program Files\PowerShell\7-preview\pwsh.exe - :\Program Files\PowerShell\7\pwsh.exe - :\Windows\System32\poqexec.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - :\Windows\SysWOW64\poqexec.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expressio
Matching passage: CVE-2015-2326. CWE: CWE-125. CVSS: 5.5. The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
Near-miss passage: CVE-2015-8763. CWE: CWE-125. CVSS: 8.100000381469727. The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
Query: weakness Exposure of Access Control List Files to an Unauthorized Control Sphere
Matching passage: CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere. The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
Near-miss passage: CWE-109 Struts: Validator Turned Off. Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
Query: rule covering Detects files dropped by Winnti as described in RedMimicry Winnti playbook
Matching passage: Sigma rule: Detects files dropped by Winnti as described in RedMimicry Winnti playbook. Logsource: windows / file_event. Rule: title: Potential Winnti Dropper Activity id: 130c9e58-28ac-4f83-8574-0a4cc913b97e status: test description: Detects files dropped by Winnti as described in RedMimicry Winnti playbook references: - https://redmimicry.com/posts/redmimicry-winnti/#dropper author: Alexander Rausch date: 2020-06-24 modified: 2023-01-05 tags: - attack.stealth - attack.t1027 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \gthread-3.6.dll - \sigcmm-2.4.dll - \Windows\Temp\tmp.bat condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Cobalt Strike module/commands accidentally entered in CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Modules id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 related: - id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 type: similar status: test description: Detects Cobalt Strike module/commands accidentally entered in CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: - Invoke-UserHunter - Invoke-ShareFinder - Invoke-Kerberoast - Invoke-SMBAutoBrute - Invoke-Nightmare - zerologon - av_query condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitr
Matching passage: CVE-2015-8560. CWE: UNKNOWN. CVSS: 7.300000190734863. Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job, a different vulnerability than CVE-2015-8327.
Near-miss passage: CVE-2015-2296. CWE: UNKNOWN. CVSS: 6.800000190734863. The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Query: write Sigma for Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitra
Matching passage: Sigma rule: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitra. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Renamed Execution id: 65c3ca2c-525f-4ced-968e-246a713d164f related: - id: a20391f8-76fb-437b-abc0-dba2df1952c6 type: similar status: test description: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: OriginalFileName: Microsoft.NodejsTools.PressAnyKey.exe filter_main_legit_name: Image|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation. Logsource: windows / process_creation. Rule: title: Suspicious MSDT Parent Process id: 7a74da6b-ea76-47db-92cc-874ad90df734 status: test description: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ author: Nextron Systems date: 2022-06-01 modified: 2023-02-06 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe - \wsl.exe selection_msdt: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe condition: all of selection_* falsepositives: - Unknown level: high
Query: detection rule: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might ind
Matching passage: Sigma rule: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might ind. Logsource: windows / process_creation. Rule: title: Persistence Via TypedPaths - CommandLine id: ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba status: test description: Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt references: - https://twitter.com/dez_/status/1560101453150257154 - https://forensafe.com/blogs/typedpaths.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 tags: - attack.persistence logsource: category: process_creation product: windows detection: selection: CommandLine|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This techni. Logsource: windows / registry_set. Rule: title: Potential EventLog File Location Tampering id: 0cb8d736-995d-4ce7-a31e-1e8d452a1459 status: test description: Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \File filter: Details|contains: \System32\Winevt\Logs\ condition: selection and not filter falsepositives: - Unknown level: high
Query: vulnerability: Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a sy
Matching passage: CVE-2015-3627. CWE: CWE-59. CVSS: 7.199999809265137. Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Near-miss passage: CVE-2015-3759. CWE: CWE-59. CVSS: 4.599999904632568. Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Query: risk of A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argu
Matching passage: CVE-2015-10054. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argument sql leads to sql injection. The identifier of the patch is 717380aba80002414f82d93c770035198b7858cc. It is recommended to apply a patch to fix this issue. The identifier VDB-218397 was assigned to this vulnerability.
Near-miss passage: CVE-2015-4454. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.
Query: ATT&CK technique for Cloud Application Integration
Matching passage: T1671 Cloud Application Integration. Tactics: persistence. Description: Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.(Citation: Push Security SaaS Persistence 2022)(Citation: SaaS Attacks GitHub Evil Twin Integrations) OAuth is an open standard that allows users to authorize applications to access their information on their behalf. In a SaaS environment such as Microsoft 365 or Google Workspace, users may integrate applications to improve their workflow and achieve tasks. Leveraging application integrations may allow adversaries to persist in an environment – for example, by granting consent to an application from a high-privileged adversary-controlled account in order to maintain access to its data, even in the event of losing access to the account.(Citation: Wiz Midnight Blizzard 2024)(Citation: Microsoft Malicious OAuth Applications 2022)(Citation: Huntress Persistence Microsoft 365 Compromise 2024) In some cases, integrations may remain valid even after the original consenting user account is disabled.(Citation: Push Security Slack Persistence 2023) Application integrations may also allow adversaries to bypass multi-factor authentication requirements through the use of [Application Access Token](https://attack.mitre.org/techniques/T1550/001)s. Finally, they may enable persistent [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) over time.(Citation: Synes Cyber Corner Malicious Azure Application 2023) Creating or adding a new application may require the adversary to create a dedicated [Cloud Account](https://attack.mitre.org/techniques/T1136/003) for the application and assign it [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) – for example, in Microsoft 365 environments, an application can only access resources via an associated service principal.(Citation: M
Near-miss passage: T1542.004 ROMMONkit. Tactics: stealth, persistence. Description: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Query: risk of Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 201
Matching passage: CVE-2015-2510. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Graphics Component Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Query: risk of The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug
Matching passage: CVE-2015-0598. CWE: CWE-19. CVSS: 6.800000190734863. The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.
Near-miss passage: CVE-2015-8985. CWE: CWE-19. CVSS: 5.900000095367432. The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detect use of PDQ Deploy remote admin tool. Logsource: windows / process_creation. Rule: title: PDQ Deploy Remote Adminstartion Tool Execution id: d679950c-abb7-43a6-80fb-2a480c4fc450 related: - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 type: similar status: test description: Detect use of PDQ Deploy remote admin tool references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md - https://www.pdq.com/pdq-deploy/ author: frack113 date: 2022-10-01 modified: 2023-01-30 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: PDQ Deploy Console - Product: PDQ Deploy - Company: PDQ.com - OriginalFileName: PDQDeployConsole.exe condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects SQL error messages that indicate probing for an injection attack. Logsource: sql / application. Rule: title: Suspicious SQL Error Messages id: 8a670c6d-7189-4b1c-8017-a417ca84a086 status: test description: Detects SQL error messages that indicate probing for an injection attack references: - http://www.sqlinjection.net/errors author: Bjoern Kimminich date: 2017-11-27 modified: 2023-02-12 tags: - attack.initial-access - attack.t1190 logsource: category: application product: sql definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)' detection: keywords: - quoted string not properly terminated - You have an error in your SQL syntax - Unclosed quotation mark - 'near "*": syntax error' - SELECTs to the left and right of UNION do not have the same number of result columns condition: keywords falsepositives: - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case. level: high
Query: describe CVE-2015-2762
Matching passage: CVE-2015-2762. CWE: CWE-200. CVSS: 5.0. Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication.
Near-miss passage: CVE-2015-0783. CWE: CWE-200. CVSS: 6.5. The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable.
Query: patch priority for CVE-2015-9235
Matching passage: CVE-2015-9235. CWE: CWE-20. CVSS: 9.800000190734863. In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Near-miss passage: CVE-2015-8702. CWE: CWE-20. CVSS: 8.600000381469727. The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
Query: Outbound C2 pattern associated with Non-Standard Port
Matching passage: T1571 Non-Standard Port. Tactics: command and control. Description: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: Suspicious Exfiltration Over Other Network Medium execution detected on endpoint
Matching passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.