alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or othe
Matching passage: Sigma rule: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or othe. Logsource: windows / process_creation. Rule: title: Unusual Child Process of dns.exe id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3 status: test description: Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2023-02-05 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dns.exe filter: Image|endswith: \conhost.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed version of the Plink binary. Logsource: windows / process_creation. Rule: title: Renamed Plink Execution id: 1c12727d-02bf-45ff-a9f3-d49806a3cf43 status: test description: Detects the execution of a renamed version of the Plink binary references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-02-03 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: Plink - CommandLine|contains|all: - ' -l forward' - ' -P ' - ' -R ' filter: Image|endswith: \plink.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: write Sigma for There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a deb
Matching passage: Sigma rule: There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a deb. Logsource: windows / process_creation. Rule: title: Malicious PE Execution by Microsoft Visual Studio Debugger id: 15c7904e-6ad1-4a45-9b46-5fb25df37fd2 status: test description: 'There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package. ' references: - https://twitter.com/pabraeken/status/990758590020452353 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/ - https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019 author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community date: 2020-10-14 modified: 2022-10-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \vsjitdebugger.exe reduction1: Image|endswith: \vsimmersiveactivatehelper*.exe reduction2: Image|endswith: \devenv.exe condition: selection and not (reduction1 or reduction2) falsepositives: - The process spawned by vsjitdebugger.exe is uncommon. level: medium
Near-miss passage: Sigma rule: Detects the use of KrbRelay, a Kerberos relaying tool. Logsource: windows / process_creation. Rule: title: HackTool - KrbRelay Execution id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 status: test description: Detects the use of KrbRelay, a Kerberos relaying tool references: - https://github.com/cube0x0/KrbRelay author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \KrbRelay.exe - OriginalFileName: KrbRelay.exe selection_cli_1: CommandLine|contains|all: - ' -spn ' - ' -clsid ' - ' -rbcd ' selection_cli_2: CommandLine|contains|all: - shadowcred - clsid - spn selection_cli_3: CommandLine|contains|all: - 'spn ' - 'session ' - 'clsid ' condition: 1 of selection_* falsepositives: - Unlikely level: high
Query: detection rule: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe
Matching passage: Sigma rule: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe. Logsource: windows / image_load. Rule: title: Amsi.DLL Loaded Via LOLBIN Process id: 6ec86d9e-912e-4726-91a2-209359b999b9 status: test description: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack references: - Internal Research - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \amsi.dll Image|endswith: - \ExtExport.exe - \odbcconf.exe - \rundll32.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitim. Logsource: windows / process_creation. Rule: title: Windows Defender Disabled Via SystemSettingsAdminFlows.EXE id: da92713f-ca2d-4fab-8320-098013d3f43a status: experimental description: 'Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks. However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns. ' references: - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ - https://www.huntress.com/blog/lolbin-to-inc-ransomware tags: - attack.defense-impairment - attack.t1685 author: Chirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 logsource: category: process_creation product: windows detection: selection_ssaf_img: - Image|endswith: \SystemSettingsAdminFlows.exe - OriginalFileName: SystemSettingsAdminFlows.EXE selection_ssaf_cli: CommandLine|contains: defender selection_cli_enable_opt: CommandLine|contains: - 'RTP ' - 'RealTimeProtection ' - 'DisableEnhancedNotifications ' selection_cli_enable_value: CommandLine|contains: '1' selection_cli_disable_opt: CommandLine|contains: - 'SubmitSamplesConsent ' - 'SpyNetReporting ' - 'DisableCDPUserAuthPolicy ' selection_cli_disable_value: CommandLine|contains: '0' condition: all of selection_ssaf_* and (all of selection_cli_enable_* or all of selection_cli_disable_*) falsepositives: - Legitimate turn off of Windows Defender by the technical users or administrators for troubleshooting or other purposes. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_systemsettingsadminflows_defender_disable/info.yml
Query: how to detect At
Matching passage: T1053.002 At. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. In addition to explicitly running the `at` command, adversaries may also schedule a task with [at](https://attack.mitre.org/software/S0110) by directly leveraging the [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) `Win32_ScheduledJob` WMI class.(Citation: Malicious Life by Cybereason) On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the <code>at.allow</code> file. If the <code>at.allow</code> file does not exist, the <code>at.deny</code> file is checked. Every username not listed in <code>at.deny</code> is allowed to invoke [at](https://attack.mitre.org/software/S0110). If the <code>at.deny</code> exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: Linux at) Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Move
Near-miss passage: T1053.007 Container Orchestration Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)
Query: detect This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t in logs
Matching passage: Sigma rule: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t. Logsource: windows / registry_set. Rule: title: Execution DLL of Choice Using WAB.EXE id: fc014922-5def-4da9-a0fc-28c973f41bfb status: test description: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry. references: - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml - https://twitter.com/Hexacorn/status/991447379864932352 - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ author: oscd.community, Natalia Shornikova date: 2020-10-13 modified: 2023-08-17 tags: - attack.stealth - attack.t1218 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\WAB\DLLPath filter: Details: '%CommonProgramFiles%\System\wab32.dll' condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse. Logsource: windows / dns_query. Rule: title: DNS Query To Visual Studio Code Tunnels Domain id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://cydefops.com/vscode-data-exfiltration author: citron_ninja date: 2023-10-25 modified: 2023-11-20 tags: - attack.command-and-control - attack.t1071.001 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: .tunnels.api.visualstudio.com condition: selection falsepositives: - Legitimate use of Visual Studio Code tunnel will also trigger this. level: medium
Query: vulnerability: ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, whic
Matching passage: CVE-2015-8866. CWE: CWE-611. CVSS: 9.600000381469727. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Near-miss passage: CVE-2015-0194. CWE: CWE-611. CVSS: 6.5. XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that. Logsource: windows / registry_set. Rule: title: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback id: 4d431012-2ab5-4db7-a84e-b29809da2172 status: test description: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship. references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista author: X__Junior (Nextron Systems) date: 2023-11-03 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: \Microsoft\WBEM\CIMOM\AllowAnonymousCallback Details: DWORD (0x00000001) condition: selection falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org. Logsource: windows / ps_script. Rule: title: Powershell Execute Batch Script id: b5522a23-82da-44e5-9c8b-e10ed8955f88 status: test description: 'Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.003/T1059.003.md#atomic-test-1---create-and-execute-batch-script author: frack113 date: 2022-01-02 tags: - attack.execution - attack.t1059.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_start: ScriptBlockText|contains: Start-Process selection_batch: ScriptBlockText|contains: - .cmd - .bat condition: all of selection_* falsepositives: - Legitimate administration script level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via Window. Logsource: windows / process_creation. Rule: title: Suspicious WindowsTerminal Child Processes id: 8de89e52-f6e1-4b5b-afd1-41ecfa300d48 status: test description: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section) references: - https://persistence-info.github.io/Data/windowsterminalprofile.html - https://twitter.com/nas_bench/status/1550836225652686848 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-25 modified: 2023-02-14 tags: - attack.execution - attack.persistence logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WindowsTerminal.exe - \wt.exe selection_susp: - Image|endswith: - \rundll32.exe - \regsvr32.exe - \certutil.exe - \cscript.exe - \wscript.exe - \csc.exe - Image|contains: - C:\Users\Public\ - \Downloads\ - \Desktop\ - \AppData\Local\Temp\ - \Windows\TEMP\ - CommandLine|contains: - ' iex ' - ' icm' - Invoke- - 'Import-Module ' - 'ipmo ' - DownloadString( - ' /c ' - ' /k ' - ' /r ' filter_builtin_visual_studio_shell: CommandLine|contains|all: - Import-Module - Microsoft.VisualStudio.DevShell.dll - Enter-VsDevShell filter_open_settings: CommandLine|contains|all: - \AppData\Local\Packages\Microsoft.WindowsTerminal_ - \LocalState\settings.json filter_vsdevcmd: CommandLine|contains|all: - C:\Program Files\Microsoft Visual Studio\ - \Common7\Tools\VsDevCmd.bat condition: all of selection_* and not 1 of filter_* falsepositives: - Other legitimate "Windows Terminal" profiles level: medium
Near-miss passage: Sigma rule: Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll. Th. Logsource: windows / process_creation. Rule: title: Potential PowerShell Execution Via DLL id: 6812a10b-60ea-420c-832f-dfcc33b646ba status: test description: 'Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine. ' references: - https://github.com/p3nt4/PowerShdll/blob/62cfa172fb4e1f7f4ac00ca942685baeb88ff356/README.md author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) date: 2018-08-25 modified: 2024-03-07 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \InstallUtil.exe - \RegAsm.exe - \RegSvcs.exe - \regsvr32.exe - \rundll32.exe - OriginalFileName: - InstallUtil.exe - RegAsm.exe - RegSvcs.exe - REGSVR32.EXE - RUNDLL32.EXE selection_cli: CommandLine|contains: - Default.GetString - DownloadString - FromBase64String - 'ICM ' - 'IEX ' - Invoke-Command - Invoke-Expression condition: all of selection_* falsepositives: - Unknown level: high
Query: Persistence mechanism resembling Cloud Service Discovery
Matching passage: T1526 Cloud Service Discovery. Tactics: discovery. Description: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API) For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu) Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685) or [Disable or Modify Cloud Log](https://attack.mitre.org/techniques/T1685/002).
Near-miss passage: T1135 Network Share Discovery. Tactics: discovery. Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.
Query: SIEM correlation: impact activity consistent with Resource Hijacking
Matching passage: T1496 Resource Hijacking. Tactics: impact. Description: Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)
Near-miss passage: T1496.002 Bandwidth Hijacking. Tactics: impact. Description: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024) In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)