alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access t in logs
Matching passage: Sigma rule: Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access t. Logsource: fortigate / event. Rule: title: FortiGate - User Group Modified id: 69ffc84e-8b1a-4024-8351-e018f66b8275 status: experimental description: 'Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.privilege-escalation logsource: product: fortigate service: event detection: selection: action: Edit cfgpath: user.group condition: selection falsepositives: - A group can be modified for legitimate purposes. level: medium
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Invocations - Generic - PowerShell Module id: bbb80e91-5746-4fbe-8898-122e2cafdbf4 related: - id: 3d304fda-78aa-43ed-975c-d740798a49c1 type: derived - id: ed965133-513f-41d9-a441-e38076a0798f type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-03-12 modified: 2023-01-03 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_encoded: ContextInfo|contains: - ' -enc ' - ' -EncodedCommand ' - ' -ec ' selection_hidden: ContextInfo|contains: - ' -w hidden ' - ' -window hidden ' - ' -windowstyle hidden ' - ' -w 1 ' selection_noninteractive: ContextInfo|contains: - ' -noni ' - ' -noninteractive ' condition: all of selection* falsepositives: - Very special / sneaky PowerShell scripts level: high
Query: common weakness: Improper Resource Locking
Matching passage: CWE-413 Improper Resource Locking. The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
Near-miss passage: CWE-422 Unprotected Windows Messaging Channel ('Shatter'). The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
Query: SIEM correlation: defense impairment activity consistent with Safe Mode Boot
Matching passage: T1688 Safe Mode Boot. Tactics: defense impairment. Description: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot) Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit) Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)
Near-miss passage: T1686.003 Windows Host Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage. This can include disabling the Windows host firewall entirely, suppressing specific profiles (domain, private, public), or adding, deleting, and modifying firewall rules to allow or restrict traffic.(Citation: Nearest Neighbor Volexity) Adversaries may perform these modifications through multiple mechanisms depending on the Windows operating system and access level. For example, adversaries may use command-line utilities (e.g., `netsh advfirewall` or PowerShell cmdlets like `Set-NetFirewallProfile`, `New-NetFirewallRule`), Windows Registry modifications (e.g., altering firewall states and rule configurations via registry keys), or the Windows Control Panel to modify firewall settings through the Windows Security interface. By disabling or modifying Windows firewall services, adversaries may enable access to remote services, open ports for command and control traffic, or configure rules for further actions.
Query: what is T1564.004
Matching passage: T1564.004 NTFS File Attributes. Tactics: stealth. Description: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
Near-miss passage: T1564.011 Ignore Process Interrupts. Tactics: stealth. Description: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. Adversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection. Hiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.
Query: vulnerability: Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH key
Matching passage: CVE-2015-7511. CWE: CWE-200. CVSS: 2.0. Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: detection rule: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC tech
Matching passage: Sigma rule: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC tech. Logsource: windows / process_creation. Rule: title: Sdclt Child Processes id: da2738f2-fadb-4394-afa7-0a0674885afa status: test description: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdclt.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard s. Logsource: windows / process_creation. Rule: title: SQL Client Tools PowerShell Session Detection id: a746c9b8-a2fb-4ee5-a428-92bee9e99060 status: test description: 'This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. ' references: - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml - https://twitter.com/pabraeken/status/993298228840992768 author: Agro (@agro_sev) oscd.communitly date: 2020-10-13 modified: 2022-02-25 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \sqltoolsps.exe - ParentImage|endswith: \sqltoolsps.exe - OriginalFileName: \sqltoolsps.exe filter: ParentImage|endswith: \smss.exe condition: selection and not filter falsepositives: - Direct PS command execution through SQLToolsPS.exe is uncommon, childprocess sqltoolsps.exe spawned by smss.exe is a legitimate action. level: medium
Query: risk of Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) b
Matching passage: CVE-2015-5776. CWE: CWE-119. CVSS: 7.5. Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
Near-miss passage: CVE-2015-7987. CWE: CWE-119. CVSS: 9.800000190734863. Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1) GetValueForIPv4Addr, (2) GetValueForMACAddr, (3) rfc3110_import, or (4) CopyNSEC3ResourceRecord function.
Query: Multiple failed authentications followed by Data from Information Repositories
Matching passage: T1213 Data from Information Repositories. Tactics: collection. Description: Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)). The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources * Contact or other sensitive information about business partners and customers, including personally identifiable information (PII) Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following: * Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases * Collaboration platforms such as SharePoint, Confluence, and code repositories * Messaging platforms such as Slack and Microsoft Teams In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relat
Near-miss passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Query: detect Detects exploitation attempt using the JNDI-Exploit-Kit in logs
Matching passage: Sigma rule: Detects exploitation attempt using the JNDI-Exploit-Kit. Logsource: webserver. Rule: title: JNDIExploit Pattern id: 412d55bc-7737-4d25-9542-5b396867ce55 status: test description: Detects exploitation attempt using the JNDI-Exploit-Kit references: - https://github.com/pimps/JNDI-Exploit-Kit - https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit author: Florian Roth (Nextron Systems) date: 2021-12-12 modified: 2022-12-25 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - /Basic/Command/Base64/ - /Basic/ReverseShell/ - /Basic/TomcatMemshell - /Basic/JettyMemshell - /Basic/WeblogicMemshell - /Basic/JBossMemshell - /Basic/WebsphereMemshell - /Basic/SpringMemshell - /Deserialization/URLDNS/ - /Deserialization/CommonsCollections1/Dnslog/ - /Deserialization/CommonsCollections2/Command/Base64/ - /Deserialization/CommonsBeanutils1/ReverseShell/ - /Deserialization/Jre8u20/TomcatMemshell - /TomcatBypass/Dnslog/ - /TomcatBypass/Command/ - /TomcatBypass/ReverseShell/ - /TomcatBypass/TomcatMemshell - /TomcatBypass/SpringMemshell - /GroovyBypass/Command/ - /WebsphereBypass/Upload/ condition: keywords falsepositives: - Legitimate apps the use these paths level: high
Near-miss passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / process_creation. Rule: title: AADInternals PowerShell Cmdlets Execution - ProccessCreation id: c86500e9-a645-4680-98d7-f882c70c1ea3 related: - id: 91e69562-2426-42ce-a647-711b8152ced6 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_cli: CommandLine|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: high
Query: patch priority for CVE-2015-9052
Matching passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Near-miss passage: CVE-2015-2463. CWE: CWE-20. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2464.
Query: detect Pre-OS Boot
Matching passage: T1542 Pre-OS Boot. Tactics: stealth, persistence. Description: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Near-miss passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Query: write Sigma for Detects scenarios where one can control another users or computers account without having to use their credentials.
Matching passage: Sigma rule: Detects scenarios where one can control another users or computers account without having to use their credentials.. Logsource: windows / security. Rule: title: Active Directory User Backdoors id: 300bac00-e041-4ee2-9c36-e262656a6ecc status: test description: Detects scenarios where one can control another users or computers account without having to use their credentials. references: - https://msdn.microsoft.com/en-us/library/cc220234.aspx - https://adsecurity.org/?p=3466 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-04-13 modified: 2024-02-26 tags: - attack.privilege-escalation - attack.t1098 - attack.persistence logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes' detection: selection1: EventID: 4738 filter_empty: AllowedToDelegateTo: - '' - '-' filter_null: AllowedToDelegateTo: null selection_5136_1: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToDelegateTo selection_5136_2: EventID: 5136 ObjectClass: user AttributeLDAPDisplayName: servicePrincipalName selection_5136_3: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToActOnBehalfOfOtherIdentity condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database). Logsource: windows / file_event. Rule: title: NTDS.DIT Created id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: ntds.dit condition: selection falsepositives: - Unknown level: low