alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in in logs
Matching passage: Sigma rule: Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in. Logsource: linux. Rule: title: Linux Command History Tampering id: fdc88d25-96fb-4b7c-9633-c0e417fdbd4e status: test description: 'Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history". ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.003/T1070.003.md - https://www.hackers-arise.com/post/2016/06/20/covering-your-bash-shell-tracks-antiforensics - https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/ author: Patrick Bareiss date: 2019-03-24 modified: 2024-04-17 tags: - attack.stealth - attack.t1070.003 logsource: product: linux detection: keywords: - cat /dev/null >*sh_history - cat /dev/zero >*sh_history - chattr +i*sh_history - echo "" >*sh_history - empty_bash_history - export HISTFILESIZE=0 - history -c - history -w - ln -sf /dev/null *sh_history - ln -sf /dev/zero *sh_history - rm *sh_history - shopt -ou history - shopt -uo history - shred *sh_history - truncate -s0 *sh_history condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / process_creation. Rule: title: Potential Active Directory Enumeration Using AD Module - ProcCreation id: 70bc5215-526f-4477-963c-a47a5c9ebd12 related: - id: 9e620995-f2d8-4630-8430-4afd89f77604 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113 date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Import-Module ' - 'ipmo ' selection_dll: CommandLine|contains: Microsoft.ActiveDirectory.Management.dll condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Query: detection rule: Detects the creation of a office macro file from a a suspicious process
Matching passage: Sigma rule: Detects the creation of a office macro file from a a suspicious process. Logsource: windows / file_event. Rule: title: Office Macro File Creation From Suspicious Process id: b1c50487-1967-4315-a026-6491686d860e status: test description: Detects the creation of a office macro file from a a suspicious process references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2023-02-22 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data' detection: selection_cmd: - Image|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - ParentImage|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_ext: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based. Logsource: macos / process_creation. Rule: title: Suspicious MacOS Firmware Activity id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099 status: test description: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers. references: - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml - https://www.manpagez.com/man/8/firmwarepasswd/ - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web author: Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.impact logsource: category: process_creation product: macos detection: selection1: Image: /usr/sbin/firmwarepasswd CommandLine|contains: - setpasswd - full - delete - check condition: selection1 falsepositives: - Legitimate administration activities level: medium
Query: Sigma rule for Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Matching passage: Sigma rule: Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp". Logsource: linux / file_event. Rule: title: Wget Creating Files in Tmp Directory id: 35a05c60-9012-49b6-a11f-6bab741c9f74 status: test description: Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp" references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.command-and-control - attack.t1105 logsource: product: linux category: file_event detection: selection: Image|endswith: /wget TargetFilename|startswith: - /tmp/ - /var/tmp/ condition: selection falsepositives: - Legitimate downloads of files in the tmp folder. level: medium
Near-miss passage: Sigma rule: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV. Logsource: windows / process_creation. Rule: title: Powershell Base64 Encoded MpPreference Cmdlet id: c6fb44c6-71f5-49e6-9462-1425d328aee3 status: test description: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV references: - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://twitter.com/AdamTheAnalyst/status/1483497517119590403 author: Florian Roth (Nextron Systems) date: 2022-03-04 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' - 'add-mppreference ' - 'set-mppreference ' - CommandLine|contains: - QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA - EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA - BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA - UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA - MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA - TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA - YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA - EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA - hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA - cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA - MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA - zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA condition: selection falsepositives: - Unknown level: high
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7637. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0207. CWE: UNKNOWN. CVSS: 5.0. The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.
Query: alert when Detects java process spawning suspicious children
Matching passage: Sigma rule: Detects java process spawning suspicious children. Logsource: linux / process_creation. Rule: title: Suspicious Java Children Processes id: d292e0af-9a18-420c-9525-ec0ac3936892 status: test description: Detects java process spawning suspicious children references: - https://www.tecmint.com/different-types-of-linux-shells/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-03 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /java CommandLine|contains: - /bin/sh - bash - dash - ksh - zsh - csh - fish - curl - wget - python condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Updated id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f status: experimental description: 'Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: UpdateGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail updates by authorized identities. level: medium
Query: patch priority for CVE-2015-2847
Matching passage: CVE-2015-2847. CWE: CWE-284. CVSS: 5.0. Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.
Near-miss passage: CVE-2015-0119. CWE: CWE-284. CVSS: 7.5. FastBack Mount in IBM Tivoli Storage Manager FastBack 6.1.x before 6.1.11.1 allows remote attackers to execute arbitrary code by connecting to the Mount port.
Query: vulnerability: Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host c
Matching passage: CVE-2015-4104. CWE: CWE-264. CVSS: 7.800000190734863. Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.
Near-miss passage: CVE-2015-6306. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.
Query: write Sigma for Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to
Matching passage: Sigma rule: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to. Logsource: windows / registry_set. Rule: title: DHCP Callout DLL Installation id: 9d3436ef-9476-4c43-acca-90ce06bdf33a status: test description: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required) references: - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx author: Dimitrios Slamaris date: 2017-05-15 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.defense-impairment - attack.t1574.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \Services\DHCPServer\Parameters\CalloutDlls - \Services\DHCPServer\Parameters\CalloutEnabled condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of system utilities to discover files and directories. Logsource: macos / process_creation. Rule: title: File and Directory Discovery - MacOS id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 status: test description: Detects usage of system utilities to discover files and directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-25 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: select_file_with_asterisk: Image: /usr/bin/file CommandLine|re: (.){200,} select_recursive_ls: Image: /bin/ls CommandLine|contains: -R select_find_execution: Image: /usr/bin/find select_mdfind_execution: Image: /usr/bin/mdfind select_tree_execution|endswith: Image: /tree condition: 1 of select* falsepositives: - Legitimate activities level: informational
Query: exploit chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a d
Matching passage: CVE-2015-1853. CWE: UNKNOWN. CVSS: 6.5. chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
Near-miss passage: CVE-2015-1594. CWE: UNKNOWN. CVSS: 6.900000095367432. Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file.
Query: vulnerability: NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct imperson
Matching passage: CVE-2015-7974. CWE: CWE-287. CVSS: 7.699999809265137. NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Near-miss passage: CVE-2015-2978. CWE: CWE-287. CVSS: 5.0. Webservice-DIC yoyaku_v41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."
Query: how to detect Virtual Private Server
Matching passage: T1584.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig) Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.
Near-miss passage: T1584 Compromise Infrastructure. Tactics: resource development. Description: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Adversaries may also compromise numerous machines to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services or to form a botnet.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) via [Wi-Fi Networks](https://attack.mitre.org/techniques/T1669).(Citation: Nearest Neighbor Volexity) By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)
Query: vulnerability: Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getG
Matching passage: CVE-2015-2996. CWE: CWE-22. CVSS: 8.5. Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
Near-miss passage: CVE-2015-2067. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Query: patch priority for CVE-2015-2199
Matching passage: CVE-2015-2199. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Near-miss passage: CVE-2015-10022. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in IISH nlgis2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file scripts/etl/custom_import.pl. The manipulation leads to sql injection. The identifier of the patch is 8bdb6fcf7209584eaf1232437f0f53e735b2b34c. It is recommended to apply a patch to fix this issue. The identifier VDB-217609 was assigned to this vulnerability.
Query: alert when Detects Obfuscated use of Clip.exe to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation CLIP+ Launcher id: b222df08-0e07-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2022-11-17 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - cmd - '&&' - 'clipboard]::' - -f CommandLine|contains: - /c - /r condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These. Logsource: windows / process_creation. Rule: title: XBAP Execution From Uncommon Locations Via PresentationHost.EXE id: d22e2925-cfd8-463f-96f6-89cec9d9bc5f status: test description: 'Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL ' references: - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \presentationhost.exe - OriginalFileName: PresentationHost.exe selection_cli: CommandLine|contains: .xbap filter_main_generic: CommandLine|contains: - ' C:\Windows\' - ' C:\Program Files' condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate ".xbap" being executed via "PresentationHost" level: medium