alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects access to Okta admin functions through proxy.
Matching passage: Sigma rule: Detects access to Okta admin functions through proxy.. Logsource: okta / okta. Rule: title: Okta Admin Functions Access Through Proxy id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309 status: test description: Detects access to Okta admin functions through proxy. references: - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach - https://dataconomy.com/2023/10/23/okta-data-breach/ - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ author: Muhammad Faisal @faisalusuf date: 2023-10-25 tags: - attack.credential-access logsource: service: okta product: okta detection: selection: debugContext.debugData.requestUri|contains: admin securityContext.isProxy: 'true' condition: selection falsepositives: - False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary level: medium
Near-miss passage: Sigma rule: Detects usage of Gpg4win to decrypt files. Logsource: windows / process_creation. Rule: title: File Decryption Using Gpg4win id: 037dcd71-33a8-4392-bb01-293c94663e5a status: test description: Detects usage of Gpg4win to decrypt files references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://www.gpg4win.de/documentation.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains|all: - ' -d ' - passphrase condition: all of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-6555
Matching passage: CVE-2015-6555. CWE: CWE-94. CVSS: 8.5. Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port.
Near-miss passage: CVE-2015-5693. CWE: CWE-94. CVSS: 7.900000095367432. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."
Query: threat report mentioning Non-Standard Port
Matching passage: T1571 Non-Standard Port. Tactics: command and control. Description: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
Near-miss passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Query: describe CVE-2015-8751
Matching passage: CVE-2015-8751. CWE: CWE-190. CVSS: 8.800000190734863. Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.
Near-miss passage: CVE-2015-9201. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, integer overflow in tzbsp can lead to privilege escalation.
Query: write Sigma for Detects common command used to enable bpf kprobes tracing
Matching passage: Sigma rule: Detects common command used to enable bpf kprobes tracing. Logsource: linux / process_creation. Rule: title: Enable BPF Kprobes Tracing id: 7692f583-bd30-4008-8615-75dab3f08a99 status: test description: Detects common command used to enable bpf kprobes tracing references: - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/ - https://bpftrace.org/ - https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-25 tags: - attack.execution - attack.stealth logsource: category: process_creation product: linux detection: selection: CommandLine|contains|all: - echo 1 > - /sys/kernel/debug/tracing/events/kprobes/ CommandLine|contains: - /myprobe/enable - /myretprobe/enable condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This te. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d related: - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd type: derived status: test description: 'Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps. ' references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ author: Ahmed Farouk, Nasreddine Bencherchali date: 2024-11-01 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: registry_set detection: selection_key: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\RunMRU selection_powershell_command: Details|contains: - powershell - pwsh selection_powershell_susp_keywords: Details|contains: - ' -e ' - ' -ec ' - ' -en ' - ' -enc ' - ' -enco' - ftp - Hidden - http - iex - Invoke- selection_wmic_command: Details|contains: wmic selection_wmic_susp_keywords: Details|contains: - shadowcopy - process call create condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*) falsepositives: - Unknown level: high
Query: secure coding against Reliance on Runtime Component in Generated Code
Matching passage: CWE-1101 Reliance on Runtime Component in Generated Code. The product uses automatically-generated code that cannot be executed without a specific runtime support component.
Near-miss passage: CWE-1291 Public Key Re-Use for Signing both Debug and Production Code. The same public key is used for signing both debug and production code.
Query: patch priority for CVE-2015-2472
Matching passage: CVE-2015-2472. CWE: CWE-20. CVSS: 4.300000190734863. Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly verify certificates, which allows man-in-the-middle attackers to spoof clients via a crafted certificate with valid Issuer and Serial Number fields, aka "Remote Desktop Session Host Spoofing Vulnerability."
Near-miss passage: CVE-2015-5074. CWE: CWE-20. CVSS: 7.5. Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Query: incident response steps for Lateral movement indicators for Exploitation for Stealth
Matching passage: Playbook for T1211 Exploitation for Stealth. 1) Validate alert telemetry against T1211. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibi
Near-miss passage: Playbook for T1055.011 Extra Window Memory Injection. Different response path focused on stealth, privilege escalation.
Query: detection rule: Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (
Matching passage: Sigma rule: Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (. Logsource: windows / process_creation. Rule: title: PowerShell MSI Install via WindowsInstaller COM From Remote Location id: 222720a7-047f-4054-baa5-bab9be757db0 status: experimental description: 'Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-06-05 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( selection_remote: CommandLine|contains: - http - \\\\ filter_main_localhost: CommandLine|contains: - ://127.0.0.1 - ://localhost condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the stopping of a Windows service via the "sc.exe" utility. Logsource: windows / process_creation. Rule: title: Stop Windows Service Via Sc.EXE id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the "sc.exe" utility references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11) author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 modified: 2024-01-18 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: sc.exe - Image|endswith: \sc.exe selection_cli: CommandLine|contains: ' stop ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
Query: Outbound C2 pattern associated with Weaken Encryption
Matching passage: T1600 Weaken Encryption. Tactics: defense impairment. Description: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.(Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.(Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1600.002 Disable Crypto Hardware. Tactics: defense impairment. Description: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks)
Query: describe CVE-2015-8226
Matching passage: CVE-2015-8226. CWE: CWE-20. CVSS: 5.5. The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225.
Near-miss passage: CVE-2015-0753. CWE: CWE-20. CVSS: 6.800000190734863. SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028.
Query: CVE similar to CVE-2015-1968
Matching passage: CVE-2015-1968. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-2932. CWE: CWE-79. CVSS: 4.300000190734863. Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.
Query: describe CVE-2015-3195
Matching passage: CVE-2015-3195. CWE: CWE-200. CVSS: 5.300000190734863. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Near-miss passage: CVE-2015-2886. CWE: CWE-200. CVSS: 7.5. iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service.
Query: CVE similar to CVE-2015-3814
Matching passage: CVE-2015-3814. CWE: CWE-189. CVSS: 5.0. The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Near-miss passage: CVE-2015-4625. CWE: CWE-189. CVSS: 4.599999904632568. Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
Query: detect One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution in logs
Matching passage: Sigma rule: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution. Logsource: windows / system. Rule: title: Eventlog Cleared id: a62b37e0-45d3-48d9-a517-90c1a1b0186b related: - id: f2f01843-e7b8-4f95-a35a-d23584476423 type: obsolete - id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982 type: derived - id: 100ef69e-3327-481c-8e5c-6d80d9507556 type: derived status: test description: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-01-10 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: system detection: selection: EventID: 104 Provider_Name: Microsoft-Windows-Eventlog filter_main_covered: Channel: - Microsoft-Windows-PowerShell/Operational - Microsoft-Windows-Sysmon/Operational - PowerShellCore/Operational - Security - System - Windows PowerShell condition: selection and not 1 of filter_main_* falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: medium
Near-miss passage: Sigma rule: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hi. Logsource: windows / process_creation. Rule: title: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 related: - id: 98c5aeef-32d5-492f-b174-64a691896d25 type: similar - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable. references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings author: Jonhnathan Ribeiro, oscd.community date: 2020-10-16 modified: 2023-02-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sdset: CommandLine|contains|all: - sdset - D; selection_trustee: CommandLine|contains: - ;IU - ;SU - ;BA - ;SY - ;WD condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud C
Matching passage: CVE-2015-7452. CWE: CWE-200. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API.
Near-miss passage: CVE-2015-7488. CWE: CWE-200. CVSS: 5.900000095367432. IBM Spectrum Scale 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1, in certain LDAP File protocol configurations, allows remote attackers to discover an LDAP password via unspecified vectors.
Query: CVE similar to CVE-2015-4346
Matching passage: CVE-2015-4346. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.
Near-miss passage: CVE-2015-6584. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.
Query: CVE similar to CVE-2015-9345
Matching passage: CVE-2015-9345. CWE: CWE-20. CVSS: 7.5. The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Near-miss passage: CVE-2015-1303. CWE: CWE-20. CVSS: 7.5. bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.