alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Matching passage: Sigma rule: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit. Logsource: windows / msexchange-management. Rule: title: Remove Exported Mailbox from Exchange Webserver id: 09570ae5-889e-43ea-aac0-0e1221fb3d95 status: test description: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430 author: Christian Burkard (Nextron Systems) date: 2021-08-27 modified: 2023-01-23 tags: - attack.stealth - attack.t1070 logsource: service: msexchange-management product: windows detection: keywords: '|all': - Remove-MailboxExportRequest - ' -Identity ' - ' -Confirm "False"' condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an organization member or an outside collaborator is added to or removed from a project board or has their. Logsource: github / audit. Rule: title: Github Outside Collaborator Detected id: eaa9ac35-1730-441f-9587-25767bde99d7 status: test description: 'Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-20 references: - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization tags: - attack.privilege-escalation - attack.persistence - attack.collection - attack.t1098.001 - attack.t1098.003 - attack.t1213.003 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - org.remove_outside_collaborator - project.update_user_permission condition: selection falsepositives: - Validate the actor if permitted to access the repo. - Validate the Multifactor Authentication changes. level: medium
Query: detection rule: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand
Matching passage: Sigma rule: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand. Logsource: windows / process_creation. Rule: title: Possible Privilege Escalation via Weak Service Permissions id: d937b75f-a665-4480-88a5-2f20e9f9b22a status: test description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/30/weak-service-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: scbynonadmin: Image|endswith: \sc.exe IntegrityLevel: - Medium - S-1-16-8192 selection_binpath: CommandLine|contains|all: - config - binPath selection_failure: CommandLine|contains|all: - failure - command condition: scbynonadmin and 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.. Logsource: windows / process_creation. Rule: title: Renamed NirCmd.EXE Execution id: 264982dc-dbad-4dce-b707-1e0d3e0f73d9 status: test description: Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields. references: - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ - https://www.nirsoft.net/utils/nircmd.html author: X__Junior (Nextron Systems) date: 2024-03-11 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: OriginalFileName: NirCmd.exe filter_main_img: Image|endswith: - \nircmd.exe - \nircmdc.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: risk of Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.
Matching passage: CVE-2015-2055. CWE: CWE-20. CVSS: 7.800000190734863. Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.
Near-miss passage: CVE-2015-8711. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
Query: patch priority for CVE-2015-4155
Matching passage: CVE-2015-4155. CWE: CWE-59. CVSS: 3.5999999046325684. GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Near-miss passage: CVE-2015-1377. CWE: CWE-59. CVSS: 4.900000095367432. The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
Query: exploit The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size val
Matching passage: CVE-2015-2869. CWE: CWE-119. CVSS: 5.0. The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value in the 1st Linker Member of a COFF Archive Library file, (3) a large Resource Table Count value in the LE Header of a Linear Executable file, or (4) a large value in a certain Object field in a Resource Table Entry in a Linear Executable file.
Near-miss passage: CVE-2015-1001. CWE: CWE-119. CVSS: 10.0. Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
Query: detect Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnorm in logs
Matching passage: Sigma rule: Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnorm. Logsource: windows / file_event. Rule: title: Suspicious Binary Writes Via AnyDesk id: 2d367498-5112-4ae5-a06a-96e7bc33a211 status: test description: 'Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details) ' references: - https://redcanary.com/blog/misbehaving-rats/ - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-28 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe TargetFilename|endswith: - .dll - .exe filter_dlls: TargetFilename|endswith: \gcapi.dll condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies when a service account is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Service Account Modified or Deleted id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 status: test description: Identifies when a service account is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1531 - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/IMPERSONATE/ACTION condition: selection falsepositives: - Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: indicators of JavaScript
Matching passage: T1059.007 JavaScript. Tactics: execution. Description: Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts) JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002). Scripts can be executed via the command line utility <code>osascript</code>, they can be compiled into applications or script files via <code>osacompile</code>, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode) Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for a
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Query: explain T1114.001 Local Email Collection
Matching passage: T1114.001 Local Email Collection. Tactics: collection. Description: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)
Near-miss passage: T1114 Email Collection. Tactics: collection. Description: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.
Query: detection rule: Detects suspicious command sequence that JexBoss
Matching passage: Sigma rule: Detects suspicious command sequence that JexBoss. Logsource: linux. Rule: title: JexBoss Command Sequence id: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae status: test description: Detects suspicious command sequence that JexBoss references: - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A author: Florian Roth (Nextron Systems) date: 2017-08-24 modified: 2025-11-22 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: '|all': - bash -c /bin/bash - '&/dev/tcp/' condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of renamed version of PAExec. Often used by attackers. Logsource: windows / process_creation. Rule: title: Renamed PAExec Execution id: c4e49831-1496-40cf-8ce1-b53f942b02f9 related: - id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b type: obsolete status: test description: Detects execution of renamed version of PAExec. Often used by attackers references: - https://www.poweradmin.com/paexec/ - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf author: Florian Roth (Nextron Systems), Jason Lynch date: 2021-05-22 modified: 2024-11-23 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: - Description: PAExec Application - OriginalFileName: PAExec.exe - Product|contains: PAExec - Hashes|contains: - IMPHASH=11D40A7B7876288F919AB819CC2D9802 - IMPHASH=6444f8a34e99b8f7d9647de66aabe516 - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c filter_main_known_location: - Image|endswith: \paexec.exe - Image|startswith: C:\Windows\PAExec- condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing - When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]" level: high
Query: Sigma rule for Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" whic
Matching passage: Sigma rule: Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" whic. Logsource: windows / process_creation. Rule: title: Potential Regsvr32 Commandline Flag Anomaly id: b236190c-1c61-41e9-84b3-3fe03f6d76b0 status: test description: Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon. references: - https://twitter.com/sbousseaden/status/1282441816986484737?s=12 author: Florian Roth (Nextron Systems) date: 2019-07-13 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: Image|endswith: \regsvr32.exe CommandLine|contains|windash: ' -i:' filter_main_flag: CommandLine|contains|windash: ' -n ' condition: selection and not 1 of filter_main_* falsepositives: - Administrator typo might cause some false positives level: medium
Near-miss passage: Sigma rule: Detects a failed installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: Failed MSExchange Transport Agent Installation id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa status: test description: Detects a failed installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-07-12 tags: - attack.persistence - attack.t1505.002 logsource: service: msexchange-management product: windows detection: selection: EventID: 6 Data|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: high
Query: describe CVE-2015-4633
Matching passage: CVE-2015-4633. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.
Near-miss passage: CVE-2015-4592. CWE: CWE-89. CVSS: 8.800000190734863. eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allows remote authenticated users to inject arbitrary malicious database commands as part of user input.
Query: alert when Detects possible NTLM coercion via certutil using the 'syncwithWU' flag
Matching passage: Sigma rule: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag. Logsource: windows / process_creation. Rule: title: Potential NTLM Coercion Via Certutil.EXE id: 6c6d9280-e6d0-4b9d-80ac-254701b64916 status: test description: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag references: - https://github.com/LOLBAS-Project/LOLBAS/issues/243 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|all: - ' -syncwithWU ' - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml
Near-miss passage: Sigma rule: Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trac. Logsource: windows / process_access. Rule: title: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c related: - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b type: similar - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 type: similar status: experimental description: 'Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques. This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period. ' references: - https://blog.axelarator.net/hunting-for-edr-freeze/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_access product: windows definition: "Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.\nExample sysmon config snippet with grouping,\ \ as logging individual ProcessAccess events can generate excessive logs:\n<ProcessAccess onmatch=\"include\">\n <Rule\ \ groupRelation=\"and\">\n <TargetImage condition=\"end with\">\\MsMpEng.exe</TargetImage>\n <SourceImage condition=\"\ end with\">\\WerFaultSecure.exe</SourceImage>\n </Rule>\n</ProcessAccess>\n" detection: selection: SourceImage|endswith: \WerFaultSecure.exe TargetImage|endswith: \MsMpEng.exe CallTrace|contains: - \dbgcore.dll - \dbghelp.dll condition: selection falsepositives: - Legitimate Windows Error Reporting operations level: high regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/info.yml
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-4446. CWE: CWE-269. CVSS: 7.5. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition from Low Integrity to Medium Integrity via unspecified vectors, a different vulnerability than CVE-2015-5090 and CVE-2015-5106.
Near-miss passage: CVE-2015-8032. CWE: CWE-269. CVSS: 5.300000190734863. In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.
Query: CVE similar to CVE-2015-5198
Matching passage: CVE-2015-5198. CWE: CWE-264. CVSS: 7.199999809265137. libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
Near-miss passage: CVE-2015-7818. CWE: CWE-264. CVSS: 7.199999809265137. The administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.