alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker lev
Matching passage: Sigma rule: Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker lev. Logsource: windows / firewall-as. Rule: title: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE id: eca81e8d-09e1-4d04-8614-c91f44fd0519 status: test description: 'Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170 - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 Action: 3 ModifyingApplication|endswith: :\Windows\System32\wbem\WmiPrvSE.exe condition: selection falsepositives: - Administrator scripts or activity. level: medium
Near-miss passage: Sigma rule: Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded. Logsource: windows / security. Rule: title: HackTool - NoFilter Execution id: 7b14c76a-c602-4ae6-9717-eff868153fc0 status: test description: 'Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators ' references: - https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp - https://github.com/deepinstinct/NoFilter - https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation - https://x.com/_st0pp3r_/status/1742203752361128162?s=20 author: Stamatis Chatzimangou (st0pp3r) date: 2024-01-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.001 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection_5447: EventID: 5447 FilterName|contains: RonPolicy selection_5449: EventID: 5449 ProviderContextName|contains: RonPolicy condition: 1 of selection_* falsepositives: - Unknown level: high
Query: secure coding against Inclusion of Sensitive Information in Source Code Comments
Matching passage: CWE-615 Inclusion of Sensitive Information in Source Code Comments. While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
Near-miss passage: CWE-366 Race Condition within a Thread. If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote authenticated users to inject arbitrary web s
Matching passage: CVE-2015-7491. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-5447. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in HP StoreOnce Backup system software before 3.13.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: detection rule: Detects the execution of the nscurl utility in order to download files.
Matching passage: Sigma rule: Detects the execution of the nscurl utility in order to download files.. Logsource: macos / process_creation. Rule: title: File Download Via Nscurl - MacOS id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf status: test description: Detects the execution of the nscurl utility in order to download files. references: - https://www.loobins.io/binaries/nscurl/ - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd author: Daniel Cortez date: 2024-06-04 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: macos detection: selection: Image|endswith: /nscurl CommandLine|contains: - '--download ' - '--download-directory ' - '--output ' - '-dir ' - '-dl ' - -ld - '-o ' condition: selection falsepositives: - Legitimate usage of nscurl by administrators and users. level: medium
Near-miss passage: Sigma rule: Detects instances where an SIP service on an OpenCanary node has had a SIP request.. Logsource: opencanary / application. Rule: title: OpenCanary - SIP Request id: e30de276-68ec-435c-ab99-ef3befec6c61 status: test description: Detects instances where an SIP service on an OpenCanary node has had a SIP request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.collection - attack.t1123 logsource: category: application product: opencanary detection: selection: logtype: 15001 condition: selection falsepositives: - Unlikely level: high
Query: exploit Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain
Matching passage: CVE-2015-0987. CWE: CWE-200. CVSS: 10.0. Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.
Near-miss passage: CVE-2015-0076. CWE: CWE-200. CVSS: 4.300000190734863. The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Query: weakness Improper Interaction Between Multiple Correctly-Behaving Entities
Matching passage: CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities. An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
Near-miss passage: CWE-221 Information Loss or Omission. The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
Query: detect Transferring files with well-known filenames (sensitive files with credential data) using network shares in logs
Matching passage: Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: windows / security. Rule: title: Transferring Files with Credential Data via Network Shares id: 910ab938-668b-401b-b08c-b596e80fdca5 related: - id: 2e69f167-47b5-4ae7-a390-47764529eff5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-07-11 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: windows service: security detection: selection_eid: EventID: 5145 selection_object: - RelativeTargetName|contains: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - RelativeTargetName: - Windows\NTDS\ntds.dit - Windows\System32\config\SAM - Windows\System32\config\SECURITY - Windows\System32\config\SYSTEM condition: all of selection_* falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium
Near-miss passage: Sigma rule: Attempts to load dismcore.dll after dropping it. Logsource: windows / image_load. Rule: title: UAC Bypass With Fake DLL id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03 status: test description: Attempts to load dismcore.dll after dropping it references: - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility author: oscd.community, Dmitry Uchakin date: 2020-10-06 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1548.002 - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \dism.exe ImageLoaded|endswith: \dismcore.dll filter: ImageLoaded: C:\Windows\System32\Dism\dismcore.dll condition: selection and not filter falsepositives: - Actions of a legitimate telnet client level: high
Query: telemetry for T1027.012
Matching passage: T1027.012 LNK Icon Smuggling. Tactics: stealth. Description: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory. Adversaries may abuse this LNK metadata to download malicious payloads. For example, adversaries have been observed using LNK files as phishing payloads to deliver malware. Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded. These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation: Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017) LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads.
Near-miss passage: T1027.002 Software Packing. Tactics: stealth. Description: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)
Query: write Sigma for This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
Matching passage: Sigma rule: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder. Logsource: windows / process_creation. Rule: title: Execution of Powershell Script in Public Folder id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4 status: test description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder references: - https://www.mandiant.com/resources/evolution-of-fin7 author: Max Altgelt (Nextron Systems) date: 2022-04-06 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - -f C:\Users\Public - -f "C:\Users\Public - -f %Public% - -fi C:\Users\Public - -fi "C:\Users\Public - -fi %Public% - -fil C:\Users\Public - -fil "C:\Users\Public - -fil %Public% - -file C:\Users\Public - -file "C:\Users\Public - -file %Public% condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / image_load. Rule: title: Wmiprvse Wbemcomn DLL Hijack id: 7707a579-e0d8-4886-a853-ce47e4575aaa status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-10-09 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: image_load detection: selection: Image|endswith: \wmiprvse.exe ImageLoaded|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: high
Query: alert when Detects usage of "find" binary in a suspicious manner to perform discovery
Matching passage: Sigma rule: Detects usage of "find" binary in a suspicious manner to perform discovery. Logsource: macos / process_creation. Rule: title: Potential Discovery Activity Using Find - MacOS id: 85de3a19-b675-4a51-bfc6-b11a5186c971 related: - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf type: similar status: test description: Detects usage of "find" binary in a suspicious manner to perform discovery references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: selection: Image|endswith: /find CommandLine|contains: - -perm -4000 - -perm -2000 - -perm 0777 - -perm -222 - -perm -o w - -perm -o x - -perm -u=s - -perm -g=s condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to ga. Logsource: windows / process_creation. Rule: title: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS id: 575dce0c-8139-4e30-9295-1ee75969f7fe related: - id: f92a6f1e-a512-4a15-9735-da09e78d7273 type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: blueteamer8699 date: 2022-01-03 modified: 2023-02-08 tags: - attack.discovery - attack.execution - attack.t1615 - attack.t1059.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: gatherNetworkInfo.vbs condition: all of selection_* falsepositives: - Administrative activity level: medium
Query: common weakness: XML Injection (aka Blind XPath Injection)
Matching passage: CWE-91 XML Injection (aka Blind XPath Injection). The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Near-miss passage: CWE-1323 Improper Management of Sensitive Trace Data. Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.
Query: Sigma rule for Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7
Matching passage: Sigma rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7. Logsource: windows / ps_script. Rule: title: PowerShell ADRecon Execution id: bf72941a-cba0-41ea-b18c-9aca3925690d status: test description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7 references: - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1 - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 author: Bhabesh Raj date: 2021-07-16 modified: 2022-09-06 tags: - attack.discovery - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Function Get-ADRExcelComOb - Get-ADRGPO - Get-ADRDomainController - ADRecon-Report.xlsx condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Query: alert when Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the
Matching passage: Sigma rule: Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the. Logsource: windows / process_creation. Rule: title: Suspicious ArcSOC.exe Child Process id: 8e95e73e-ba02-4a87-b4d7-0929b8053038 status: experimental description: 'Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \ArcSOC.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wmic.exe - \wscript.exe filter_main_cmd: Image|endswith: \cmd.exe CommandLine: cmd.exe /c "ver" condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / process_creation. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet id: 435e10e4-992a-4281-96f3-38b11106adde related: - id: db885529-903f-4c5d-9864-28fe199e6370 type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - 'Get-ADComputer ' - ' -Filter \*' CommandLine|contains: - ' > ' - ' | Select ' - Out-File - Set-Content - Add-Content condition: all of selection_* falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium