alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects usage of "find" binary in a suspicious manner to perform discovery
Matching passage: Sigma rule: Detects usage of "find" binary in a suspicious manner to perform discovery. Logsource: linux / process_creation. Rule: title: Potential Discovery Activity Using Find - Linux id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf related: - id: 85de3a19-b675-4a51-bfc6-b11a5186c971 type: similar status: test description: Detects usage of "find" binary in a suspicious manner to perform discovery references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /find CommandLine|contains: - -perm -4000 - -perm -2000 - -perm 0777 - -perm -222 - -perm -o w - -perm -o x - -perm -u=s - -perm -g=s condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons. Logsource: windows / create_remote_thread. Rule: title: HackTool - Potential CobaltStrike Process Injection id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42 status: test description: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons references: - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/ author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community date: 2018-11-30 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: product: windows category: create_remote_thread detection: selection: StartAddress|endswith: - 0B80 - 0C7C - 0C88 condition: selection falsepositives: - Unknown level: high
Query: alert when Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "re
Matching passage: Sigma rule: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "re. Logsource: windows / process_creation. Rule: title: Scripting/CommandLine Process Spawned Regsvr32 id: ab37a6ec-6068-432b-a64e-2c7bf95b1d22 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \wscript.exe Image|endswith: \regsvr32.exe filter_main_rpcproxy: ParentImage: C:\Windows\System32\cmd.exe CommandLine|endswith: ' /s C:\Windows\System32\RpcProxy\RpcProxy.dll' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary - Some legitimate Windows services level: medium
Near-miss passage: Sigma rule: Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one o. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Kubernetes CronJob id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435 status: test description: 'Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster. ' references: - https://cloud.google.com/kubernetes-engine/docs - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ - https://kubernetes.io/docs/concepts/workloads/controllers/job/ author: Austin Songer @austinsonger date: 2021-11-22 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - io.k8s.api.batch.v*.Job - io.k8s.api.batch.v*.CronJob condition: selection falsepositives: - Google Cloud Kubernetes CronJob/Job may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: exploit WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5812. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-4144. CWE: CWE-119. CVSS: 5.0. The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Query: explain CWE-456
Matching passage: CWE-456 Missing Initialization of a Variable. The product does not initialize critical variables, which causes the execution environment to use unexpected values.
Near-miss passage: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Query: rule covering Detects usage of Gpg4win to encrypt files
Matching passage: Sigma rule: Detects usage of Gpg4win to encrypt files. Logsource: windows / process_creation. Rule: title: File Encryption Using Gpg4win id: 550bbb84-ce5d-4e61-84ad-e590f0024dcd status: test description: Detects usage of Gpg4win to encrypt files references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://www.gpg4win.de/documentation.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains|all: - ' -c ' - passphrase condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects command line parameters or strings often used by crypto miners. Logsource: windows / process_creation. Rule: title: Potential Crypto Mining Activity id: 66c3b204-9f88-4d0a-a7f7-8a57d521ca55 status: stable description: Detects command line parameters or strings often used by crypto miners references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 modified: 2023-02-13 tags: - attack.impact - attack.t1496 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' --cpu-priority=' - --donate-level=0 - ' -o pool.' - ' --nicehash' - ' --algo=rx/0 ' - stratum+tcp:// - stratum+udp:// - LS1kb25hdGUtbGV2ZWw9 - 0tZG9uYXRlLWxldmVsP - tLWRvbmF0ZS1sZXZlbD - c3RyYXR1bSt0Y3A6Ly - N0cmF0dW0rdGNwOi8v - zdHJhdHVtK3RjcDovL - c3RyYXR1bSt1ZHA6Ly - N0cmF0dW0rdWRwOi8v - zdHJhdHVtK3VkcDovL filter: CommandLine|contains: - ' pool.c ' - ' pool.o ' - gcc - condition: selection and not filter falsepositives: - Legitimate use of crypto miners - Some build frameworks level: high
Query: SOC alert related to System Shutdown/Reboot
Matching passage: T1529 System Shutdown/Reboot. Tactics: impact. Description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</code>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023) In some cases, the system may not be able to boot again. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
Near-miss passage: T1485.001 Lifecycle-Triggered Deletion. Tactics: impact. Description: Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within. Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time.(Citation: AWS Storage Lifecycles)(Citation: GCP Storage Lifecycles)(Citation: Azure Storage Lifecycles) If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once. For example, in AWS environments, an adversary with the `PutLifecycleConfiguration` permission may use the `PutBucketLifecycle` API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day.(Citation: Palo Alto Cloud Ransomware)(Citation: Halcyon AWS Ransomware 2025) In addition to destroying data for purposes of extortion and [Financial Theft](https://attack.mitre.org/techniques/T1657), adversaries may also perform this action on buckets storing cloud logs for [Indicator Removal](https://attack.mitre.org/techniques/T1070).(Citation: Datadog S3 Lifecycle CloudTrail Logs)
Query: vulnerability: Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitrary code or cause a denial of service (me
Matching passage: CVE-2015-7029. CWE: CWE-119. CVSS: 9.800000190734863. Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-6360. CWE: CWE-119. CVSS: 7.5. The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.
Query: patch priority for CVE-2015-9041
Matching passage: CVE-2015-9041. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists when performing WCDMA radio tuning.
Near-miss passage: CVE-2015-3701. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3702.
Query: risk of Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of se
Matching passage: CVE-2015-7198. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.
Near-miss passage: CVE-2015-5934. CWE: CWE-119. CVSS: 6.800000190734863. Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerability than CVE-2015-5933.
Query: patch priority for CVE-2015-8316
Matching passage: CVE-2015-8316. CWE: CWE-129. CVSS: 5.900000095367432. Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.
Near-miss passage: CVE-2015-8366. CWE: CWE-129. CVSS: 9.800000190734863. Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.
Query: alert when Detects the use of 3proxy, a tiny free proxy server
Matching passage: Sigma rule: Detects the use of 3proxy, a tiny free proxy server. Logsource: windows / process_creation. Rule: title: PUA - 3Proxy Execution id: f38a82d2-fba3-4781-b549-525efbec8506 status: test description: Detects the use of 3proxy, a tiny free proxy server references: - https://github.com/3proxy/3proxy - https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-09-13 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \3proxy.exe selection_pe: Description: 3proxy - tiny proxy server selection_params: CommandLine|contains: .exe -i127.0.0.1 -p condition: 1 of selection_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Detects potential process patterns related to Cobalt Strike beacon activity. Logsource: windows / process_creation. Rule: title: Potential CobaltStrike Process Patterns id: f35c5d71-b489-4e22-a115-f003df287317 status: test description: Detects potential process patterns related to Cobalt Strike beacon activity references: - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-27 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_generic_1: CommandLine|endswith: cmd.exe /C whoami ParentImage|startswith: C:\Temp\ selection_generic_2: ParentImage|endswith: - \runonce.exe - \dllhost.exe CommandLine|contains|all: - cmd.exe /c echo - '> \\\\.\\pipe' selection_conhost_1: ParentCommandLine|contains|all: - cmd.exe /C echo - ' > \\\\.\\pipe' CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 selection_conhost_2: ParentCommandLine|endswith: /C whoami CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 condition: 1 of selection_* falsepositives: - Unknown level: high
Query: exploit The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word d
Matching passage: CVE-2015-3774. CWE: CWE-20. CVSS: 4.800000190734863. The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream.
Near-miss passage: CVE-2015-0717. CWE: CWE-20. CVSS: 6.900000095367432. Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
Query: rule covering Detect suspicious parent processes of well-known Windows processes
Matching passage: Sigma rule: Detect suspicious parent processes of well-known Windows processes. Logsource: windows / process_creation. Rule: title: Windows Processes Suspicious Parent Directory id: 96036718-71cc-4027-a538-d1587e0006a7 status: test description: Detect suspicious parent processes of well-known Windows processes references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/ - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf author: vburov date: 2019-02-23 modified: 2025-03-06 tags: - attack.stealth - attack.t1036.003 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \svchost.exe - \taskhost.exe - \lsm.exe - \lsass.exe - \services.exe - \lsaiso.exe - \csrss.exe - \wininit.exe - \winlogon.exe filter_sys: - ParentImage|endswith: - \SavService.exe - \ngen.exe - ParentImage|contains: - \System32\ - \SysWOW64\ filter_msmpeng: ParentImage|contains: - \Windows Defender\ - \Microsoft Security Client\ ParentImage|endswith: \MsMpEng.exe filter_null: - ParentImage: null - ParentImage: - '' - '-' condition: selection and not 1 of filter_* falsepositives: - Some security products seem to spawn these level: low
Near-miss passage: Sigma rule: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.. Logsource: windows / wmi. Rule: title: WMI Persistence id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b status: test description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. references: - https://twitter.com/mattifestation/status/899646620148539397 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community date: 2017-08-22 modified: 2022-02-10 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows service: wmi definition: WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher detection: wmi_filter_to_consumer_binding: EventID: 5861 consumer_keywords: - ActiveScriptEventConsumer - CommandLineEventConsumer - CommandLineTemplate wmi_filter_registration: EventID: 5859 filter_scmevent: Provider: SCM Event Provider Query: select * from MSFT_SCMEventLogEvent User: S-1-5-32-544 PossibleCause: Permanent condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent falsepositives: - Unknown (data set is too small; further testing needed) level: medium
Query: risk of Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-4443. CWE: CWE-476. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to cause a denial of service (NULL pointer dereference) via unspecified vectors, a different vulnerability than CVE-2015-4444.
Near-miss passage: CVE-2015-4054. CWE: CWE-476. CVSS: 7.5. PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
Query: patch priority for CVE-2015-4322
Matching passage: CVE-2015-4322. CWE: CWE-264. CVSS: 5.5. Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, aka Bug ID CSCuv65894.
Near-miss passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Query: risk of Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Matching passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Near-miss passage: CVE-2015-8705. CWE: CWE-20. CVSS: 7.0. buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Query: patch priority for CVE-2015-5765
Matching passage: CVE-2015-5765. CWE: CWE-20. CVSS: 4.300000190734863. The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.
Near-miss passage: CVE-2015-9146. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, SD 400, SD 800, SD 835, SD 845, SD 850, and SDX20, when QDI read, write, or ioctl are called, the passed-in pointer is not properly validated before accessing it for the delayed response.