alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Malware
Matching passage: T1588.001 Malware. Tactics: resource development. Description: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
Near-miss passage: T1588 Obtain Capabilities. Tactics: resource development. Description: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
Query: patch priority for CVE-2015-9011
Matching passage: CVE-2015-9011. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882.
Near-miss passage: CVE-2015-0981. CWE: CWE-264. CVSS: 7.5. The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors.
Query: vulnerability: The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial o
Matching passage: CVE-2015-4602. CWE: UNKNOWN. CVSS: 9.800000190734863. The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Near-miss passage: CVE-2015-7642. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7643, and CVE-2015-7644.
Query: detect Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. in logs
Matching passage: Sigma rule: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud VPN Tunnel Modified or Deleted id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1 status: test description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. references: - https://any-api.com/googleapis_com/compute/docs/vpnTunnels author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - compute.vpnTunnels.insert - compute.vpnTunnels.delete condition: selection falsepositives: - VPN Tunnel being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand". Logsource: windows / process_creation. Rule: title: Service StartupType Change Via Sc.EXE id: 85c312b7-f44d-4a51-a024-d671c40b49fc status: test description: Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand" references: - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-03-04 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains|all: - ' config ' - start CommandLine|contains: - disabled - demand condition: all of selection_* falsepositives: - False positives may occur with troubleshooting scripts level: medium
Query: secure coding against Insufficient Adherence to Expected Conventions
Matching passage: CWE-1076 Insufficient Adherence to Expected Conventions. The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.
Near-miss passage: CWE-375 Returning a Mutable Object to an Untrusted Caller. Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
Query: vulnerability: Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash ca
Matching passage: CVE-2015-1015. CWE: CWE-200. CVSS: 2.0999999046325684. Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-2998. CWE: CWE-200. CVSS: 5.0. SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.
Query: CVE similar to CVE-2015-10122
Matching passage: CVE-2015-10122. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of the file includes/donate-display.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.5 is able to address this issue. The identifier of the patch is 019114cb788d954c5d1b36d6c62418619e93a757. It is recommended to upgrade the affected component. The identifier VDB-234249 was assigned to this vulnerability.
Near-miss passage: CVE-2015-9466. CWE: CWE-89. CVSS: 9.800000190734863. The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
Query: SIEM correlation: defense impairment activity consistent with Password Filter DLL
Matching passage: T1556.002 Password Filter DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)
Near-miss passage: T1556.001 Domain Controller Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)
Query: rule covering Detects potential DLL sideloading of "SolidPDFCreator.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "SolidPDFCreator.dll". Logsource: windows / image_load. Rule: title: Potential SolidPDFCreator.DLL Sideloading id: a2edbce1-95c8-4291-8676-0d45146862b3 status: test description: Detects potential DLL sideloading of "SolidPDFCreator.dll" references: - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/ author: X__Junior (Nextron Systems) date: 2023-05-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \SolidPDFCreator.dll filter_main_path: Image|endswith: \SolidPDFCreator.exe ImageLoaded|startswith: - C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\ - C:\Program Files\SolidDocuments\SolidPDFCreator\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service. Logsource: windows / security. Rule: title: Password Change on Directory Service Restore Mode (DSRM) Account id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 related: - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 type: similar status: stable description: 'Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence. ' references: - https://adsecurity.org/?p=1714 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794 author: Thomas Patzke date: 2017-02-19 modified: 2020-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: 4794 condition: selection falsepositives: - Initial installation of a domain controller. level: high
Query: Sigma rule for Detects program executions in suspicious non-program folders related to malware or hacking activity
Matching passage: Sigma rule: Detects program executions in suspicious non-program folders related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Program Executions in Suspicious Folders id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc status: test description: Detects program executions in suspicious non-program folders related to malware or hacking activity references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-01-23 modified: 2021-11-27 tags: - attack.t1587 - attack.t1584 - attack.resource-development logsource: product: linux service: auditd detection: selection: type: SYSCALL exe|startswith: - /tmp/ - /var/www/ - /home/*/public_html/ - /usr/local/apache2/ - /usr/local/httpd/ - /var/apache/ - /srv/www/ - /home/httpd/html/ - /srv/http/ - /usr/share/nginx/html/ - /var/lib/pgsql/data/ - /usr/local/mysql/data/ - /var/lib/mysql/ - /var/vsftpd/ - /etc/bind/ - /var/named/ condition: selection falsepositives: - Admin activity (especially in /tmp folders) - Crazy web applications level: medium
Near-miss passage: Sigma rule: Detects disabling Windows Defender Exploit Guard Network Protection. Logsource: windows / registry_set. Rule: title: Disable Exploit Guard Network Protection on Windows Defender id: bf9e1387-b040-4393-9851-1598f8ecfae9 status: test description: Detects disabling Windows Defender Exploit Guard Network Protection references: - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride Details: DWORD (00000001) condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-4257
Matching passage: CVE-2015-4257. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence MCU 4500 devices with software 4.5(1.55) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90710.
Near-miss passage: CVE-2015-6376. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv72412.
Query: alert when Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org
Matching passage: Sigma rule: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org. Logsource: windows / process_creation. Rule: title: Chromium Browser Headless Execution To Mockbin Like Site id: 1c526788-0abe-4713-862f-b520da5e5316 status: test description: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data). references: - https://www.zscaler.com/blogs/security-research/steal-it-campaign author: X__Junior (Nextron Systems) date: 2023-09-11 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_headless: CommandLine|contains: --headless selection_url: CommandLine|contains: - ://run.mocky - ://mockbin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml
Near-miss passage: Sigma rule: Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume. Logsource: windows / process_creation. Rule: title: Wlrmdr.EXE Uncommon Argument Or Child Process id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb status: experimental description: 'Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry. ' references: - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/ author: frack113, manasmbellani date: 2022-02-16 modified: 2025-10-31 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \wlrmdr.exe selection_child_img: - Image|endswith: \wlrmdr.exe - OriginalFileName: WLRMNDR.EXE selection_child_cli_flags_s: CommandLine|contains|windash: '-s ' selection_child_cli_flags_f: CommandLine|contains|windash: '-f ' selection_child_cli_flags_t: CommandLine|contains|windash: '-t ' selection_child_cli_flags_m: CommandLine|contains|windash: '-m ' selection_child_cli_flags_a: CommandLine|contains|windash: '-a ' selection_child_cli_flags_u: CommandLine|contains|windash: '-u ' filter_main_winlogon: ParentImage: C:\Windows\System32\winlogon.exe filter_main_empty: ParentImage: - '' - '-' filter_main_null: ParentImage: null condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*) falsepositives: - Unknown level: medium
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Near-miss passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting. Logsource: windows / process_creation. Rule: title: Potential Meterpreter/CobaltStrike Activity id: 15619216-e993-4721-b590-4c520615a67d status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth date: 2019-10-26 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: category: process_creation product: windows detection: selection_img: ParentImage|endswith: \services.exe selection_technique_1: CommandLine|contains|all: - /c - echo - \pipe\ CommandLine|contains: - cmd - '%COMSPEC%' selection_technique_2: CommandLine|contains|all: - rundll32 - .dll,a - '/p:' filter_defender: CommandLine|contains: MpCmdRun condition: selection_img and 1 of selection_technique_* and not 1 of filter_* falsepositives: - Commandlines containing components like cmd accidentally - Jobs and services started with cmd level: high
Query: detect Detects read access to a domain user from a non-machine account in logs
Matching passage: Sigma rule: Detects read access to a domain user from a non-machine account. Logsource: windows / security. Rule: title: Potential AD User Enumeration From Non-Machine Account id: ab6bffca-beff-4baa-af11-6733f296d57a status: test description: Detects read access to a domain user from a non-machine account references: - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662 author: Maxime Thiebaut (@0xThiebaut) date: 2020-03-30 modified: 2022-11-08 tags: - attack.discovery - attack.t1087.002 logsource: product: windows service: security definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal' detection: selection: EventID: 4662 ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2 AccessMask|endswith: - 1? - 3? - 4? - 7? - 9? - B? - D? - F? filter_main_machine_accounts: SubjectUserName|endswith: $ filter_main_msql: SubjectUserName|startswith: MSOL_ condition: selection and not 1 of filter_main_* falsepositives: - Administrators configuring new users. level: medium
Near-miss passage: Sigma rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Invocation Via Ssh - Linux id: 8737b7f6-8df3-4bb7-b1da-06019b99b687 status: test description: 'Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/ssh/ - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-08-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /ssh CommandLine|contains: - ProxyCommand=; - permitlocalcommand=yes - localhost selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh - sh 0<&2 1>&2 - sh 1>&2 0<&2 condition: all of selection_* falsepositives: - Unknown level: high