alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line i. Logsource: windows / ps_script. Rule: title: Powershell XML Execute Command id: 6c6c6282-7671-4fe9-a0ce-a2dcebdc342b status: test description: 'Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-8---powershell-xml-requests author: frack113 date: 2022-01-19 modified: 2023-01-19 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_xml: ScriptBlockText|contains|all: - New-Object - System.Xml.XmlDocument - .Load selection_exec: ScriptBlockText|contains: - 'IEX ' - 'Invoke-Expression ' - 'Invoke-Command ' - ICM - condition: all of selection_* falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects the modification of Outlook security setting to allow unprompted execution of macros.. Logsource: windows / registry_set. Rule: title: Outlook Macro Execution Without Warning Setting Enabled id: e3b50fa5-3c3f-444e-937b-0a99d33731cd status: test description: Detects the modification of Outlook security setting to allow unprompted execution of macros. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 author: '@ScoubiMtl' date: 2021-04-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\Level Details|contains: '0x00000001' condition: selection falsepositives: - Unlikely level: high
Query: mitigate Web Service
Matching passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Near-miss passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: patch priority for CVE-2015-5712
Matching passage: CVE-2015-5712. CWE: CWE-200. CVSS: 4.0. Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote authenticated users to obtain sensitive system information by visiting an unspecified URL.
Near-miss passage: CVE-2015-2058. CWE: CWE-200. CVSS: 6.5. c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
Query: write Sigma for Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Matching passage: Sigma rule: Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.. Logsource: windows / process_creation. Rule: title: Active Directory Structure Export Via Ldifde.EXE id: 4f7a6757-ff79-46db-9687-66501a02d9ec status: test description: Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure. references: - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection_ldif: - Image|endswith: \ldifde.exe - OriginalFileName: ldifde.exe selection_cmd: CommandLine|contains: -f filter_import: CommandLine|contains: ' -i' condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted en. Logsource: linux / process_creation. Rule: title: Nohup Execution id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2 status: test description: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments references: - https://gtfobins.github.io/gtfobins/nohup/ - https://en.wikipedia.org/wiki/Nohup - https://www.computerhope.com/unix/unohup.htm author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-06 tags: - attack.execution - attack.t1059.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: /nohup condition: selection falsepositives: - Administrators or installed processes that leverage nohup level: medium
Query: risk of The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functio
Matching passage: CVE-2015-8954. CWE: CWE-264. CVSS: 9.800000190734863. The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request.
Near-miss passage: CVE-2015-1885. CWE: CWE-264. CVSS: 9.300000190734863. WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors.
Query: patch priority for CVE-2015-4342
Matching passage: CVE-2015-4342. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Near-miss passage: CVE-2015-10045. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
Query: patch priority for CVE-2015-7296
Matching passage: CVE-2015-7296. CWE: UNKNOWN. CVSS: 4.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914.
Near-miss passage: CVE-2015-0457. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2629.
Query: detect This rule detects suspicious files created by Microsoft Sync Center (mobsync) in logs
Matching passage: Sigma rule: This rule detects suspicious files created by Microsoft Sync Center (mobsync). Logsource: windows / file_event. Rule: title: Created Files by Microsoft Sync Center id: 409f8a98-4496-4aaa-818a-c931c0a8b832 status: test description: This rule detects suspicious files created by Microsoft Sync Center (mobsync) references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 modified: 2022-06-02 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1218 - attack.execution logsource: product: windows category: file_event detection: selection_mobsync: Image|endswith: \mobsync.exe filter_created_file: TargetFilename|endswith: - .dll - .exe condition: selection_mobsync and filter_created_file falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect remote login by Administrator user (depending on internal pattern).. Logsource: windows / security. Rule: title: Admin User Remote Logon id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a status: test description: Detect remote login by Administrator user (depending on internal pattern). references: - https://car.mitre.org/wiki/CAR-2016-04-005 author: juju4 date: 2017-10-29 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.initial-access - attack.stealth - attack.t1078.001 - attack.t1078.002 - attack.t1078.003 - car.2016-04-005 logsource: product: windows service: security definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account' detection: selection: EventID: 4624 LogonType: 10 AuthenticationPackageName: Negotiate TargetUserName|startswith: Admin condition: selection falsepositives: - Legitimate administrative activity. level: low
Query: detect Detects the execution of the nscurl utility in order to download files. in logs
Matching passage: Sigma rule: Detects the execution of the nscurl utility in order to download files.. Logsource: macos / process_creation. Rule: title: File Download Via Nscurl - MacOS id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf status: test description: Detects the execution of the nscurl utility in order to download files. references: - https://www.loobins.io/binaries/nscurl/ - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd author: Daniel Cortez date: 2024-06-04 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: macos detection: selection: Image|endswith: /nscurl CommandLine|contains: - '--download ' - '--download-directory ' - '--output ' - '-dir ' - '-dl ' - -ld - '-o ' condition: selection falsepositives: - Legitimate usage of nscurl by administrators and users. level: medium
Near-miss passage: Sigma rule: Detect set UseActionCenterExperience to 0 to disable the Windows security center notification. Logsource: windows / registry_set. Rule: title: Disable Windows Security Center Notifications id: 3ae1a046-f7db-439d-b7ce-b8b366b81fa6 status: test description: Detect set UseActionCenterExperience to 0 to disable the Windows security center notification references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: Windows\CurrentVersion\ImmersiveShell\UseActionCenterExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/info.yml simulation: - type: atomic-red-team name: Disable Windows Security Center Notifications technique: T1112 atomic_guid: 45914594-8df6-4ea9-b3cc-7eb9321a807e
Query: Sigma YAML for windows / application
Matching passage: Sigma rule: Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Servi. Logsource: windows / application. Rule: title: LSASS Process Crashed - Application id: a18e0862-127b-43ca-be12-1a542c75c7c5 status: experimental description: 'Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials. ' references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-07 modified: 2025-12-03 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: application detection: selection: Provider_Name: Application Error EventID: 1000 AppName: lsass.exe ExceptionCode: c0000001 condition: selection falsepositives: - Rare legitimate crashing of the lsass process level: high
Near-miss passage: Sigma rule: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi. Logsource: windows / registry_event. Rule: title: HybridConnectionManager Service Installation - Registry id: ac8866c7-ce44-46fd-8c17-b24acff96ca8 status: test description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-11-27 tags: - attack.resource-development - attack.t1608 logsource: category: registry_event product: windows detection: selection1: TargetObject|contains: \Services\HybridConnectionManager selection2: EventType: SetValue Details|contains: Microsoft.HybridConnectionManager.Listener.exe condition: selection1 or selection2 falsepositives: - Unknown level: high
Query: alert when Detects Obfuscated Powershell via RUNDLL LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module id: a23791fe-8846-485a-b16b-ca691e1b03d4 related: - id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 type: derived status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection_4103 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like. Logsource: windows / security. Rule: title: RottenPotato Like Attack Pattern id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f status: test description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like references: - https://twitter.com/SBousseaden/status/1195284233729777665 author: '@SBousseaden, Florian Roth' date: 2019-11-15 modified: 2022-12-22 tags: - attack.collection - attack.privilege-escalation - attack.credential-access - attack.t1557.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 TargetUserName: ANONYMOUS LOGON WorkstationName: '-' IpAddress: - 127.0.0.1 - ::1 condition: selection falsepositives: - Unknown level: high
Query: risk of WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5819. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5689. CWE: CWE-119. CVSS: 6.800000190734863. ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code, cause a denial of service (application crash), or possibly obtain sensitive information via a crafted Ghost image.
Query: vulnerability: The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttempl
Matching passage: CVE-2015-4027. CWE: CWE-264. CVSS: 7.199999809265137. The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan.
Near-miss passage: CVE-2015-6859. CWE: CWE-264. CVSS: 7.800000190734863. HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2015-6860.
Query: rule covering Detects execution of AppX packages with known suspicious or malicious signature
Matching passage: Sigma rule: Detects execution of AppX packages with known suspicious or malicious signature. Logsource: windows / appxpackaging-om. Rule: title: Suspicious Digital Signature Of AppX Package id: b5aa7d60-c17e-4538-97de-09029d6cd76b status: test description: Detects execution of AppX packages with known suspicious or malicious signature references: - Internal Research - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.execution - attack.stealth logsource: product: windows service: appxpackaging-om detection: selection: EventID: 157 subjectName: CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: windows / process_creation. Rule: title: Suspicious Git Clone id: aef9d1f1-7396-4e92-a927-4567c7a495c1 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-10 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \git.exe - \git-remote-https.exe - OriginalFileName: git.exe selection_cli: CommandLine|contains: - ' clone ' - 'git-remote-https ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium