alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe
Matching passage: Sigma rule: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebe. Logsource: windows / process_creation. Rule: title: ImagingDevices Unusual Parent/Child Processes id: f11f2808-adb4-46c0-802a-8660db50fa99 status: test description: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2022-12-29 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: \ImagingDevices.exe selection_child: ParentImage|endswith: \ImagingDevices.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo. Logsource: windows / registry_set. Rule: title: Default RDP Port Changed to Non Standard Port id: 509e84b9-a71a-40e0-834f-05470369bd1e status: test description: 'Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md author: frack113 date: 2022-01-01 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Terminal Server\WinStations\RDP-Tcp\PortNumber filter_main_port: Details: DWORD (0x00000d3d) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml simulation: - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Powershell technique: T1021.001 atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Command_Prompt technique: T1021.001 atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
Query: CVE similar to CVE-2015-1618
Matching passage: CVE-2015-1618. CWE: CWE-200. CVSS: 4.0. The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL.
Near-miss passage: CVE-2015-3373. CWE: CWE-200. CVSS: 5.0. The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
Query: CVE similar to CVE-2015-0753
Matching passage: CVE-2015-0753. CWE: CWE-20. CVSS: 6.800000190734863. SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028.
Near-miss passage: CVE-2015-1554. CWE: CWE-20. CVSS: 7.5. kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension id: e9f8f8cc-07cc-4e81-b724-f387db9175e4 related: - id: cc368ed0-2411-45dc-a222-510ace303cb2 type: derived status: test description: Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension. references: - https://www.fortiguard.com/threat-signal-report/4718?s=09 - https://lolbas-project.github.io/lolbas/Binaries/Regasm/ - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-13 tags: - attack.stealth - attack.t1218.009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \Regsvcs.exe - \Regasm.exe - OriginalFileName: - RegSvcs.exe - RegAsm.exe selection_extension: CommandLine|contains: - .dat - .gif - .jpeg - .jpg - .png - .txt condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.. Logsource: windows / ps_script. Rule: title: Powershell Store File In Alternate Data Stream id: a699b30e-d010-46c8-bbd1-ee2e26765fe9 status: test description: Storing files in Alternate Data Stream (ADS) similar to Astaroth malware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: frack113 date: 2021-09-02 modified: 2022-12-25 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_compspec: ScriptBlockText|contains|all: - Start-Process - '-FilePath "$env:comspec" ' - '-ArgumentList ' - '>' condition: selection_compspec falsepositives: - Unknown level: medium
Query: rule covering Detects installation of a remote msi file from web.
Matching passage: Sigma rule: Detects installation of a remote msi file from web.. Logsource: windows / application. Rule: title: MSI Installation From Web id: 5594e67a-7f92-4a04-b65d-1a42fd824a60 status: test description: Detects installation of a remote msi file from web. references: - https://twitter.com/_st0pp3r_/status/1583922009842802689 author: Stamatis Chatzimangou date: 2022-10-23 tags: - attack.stealth - attack.t1218 - attack.t1218.007 logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1040 - 1042 Data|contains: :// condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes a. Logsource: linux / process_creation. Rule: title: User Has Been Deleted Via Userdel id: 08f26069-6f80-474b-8d1f-d971c6fedea0 status: test description: Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks references: - https://linuxize.com/post/how-to-delete-group-in-linux/ - https://www.cyberciti.biz/faq/linux-remove-user-command/ - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/ - https://linux.die.net/man/8/userdel author: Tuan Le (NCSGroup) date: 2022-12-26 tags: - attack.impact - attack.t1531 logsource: product: linux category: process_creation detection: selection: Image|endswith: /userdel condition: selection falsepositives: - Legitimate administrator activities level: medium
Query: patch priority for CVE-2015-4530
Matching passage: CVE-2015-4530. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to hijack the authentication of arbitrary users. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2518.
Near-miss passage: CVE-2015-0895. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Query: risk of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10.5.e Build 53-9010.e allow remote attackers to cause a denial
Matching passage: CVE-2015-2829. CWE: UNKNOWN. CVSS: 7.800000190734863. Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.5 Build 53.9 through 55.8 and 10.5.e Build 53-9010.e allow remote attackers to cause a denial of service (reboot) via unspecified vectors.
Near-miss passage: CVE-2015-1775. CWE: UNKNOWN. CVSS: 5.5. Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
Query: mitigate Trusted Developer Utilities Proxy Execution
Matching passage: T1127 Trusted Developer Utilities Proxy Execution. Tactics: stealth, execution. Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them.(Citation: Microsoft Smart App Control) However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) to run their malicious code, adversaries may bypass Smart App Control protections.(Citation: Elastic Security Labs)
Near-miss passage: T1127.003 JamPlus. Tactics: stealth, execution. Description: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual) Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.(Citation: Cyble)(Citation: Elastic Security Labs)
Query: detection rule: Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their mal
Matching passage: Sigma rule: Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their mal. Logsource: windows / process_creation. Rule: title: Data Export From MSSQL Table Via BCP.EXE id: c615d676-f655-46b9-b913-78729021e5d7 status: test description: 'Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file. ' references: - https://docs.microsoft.com/en-us/sql/tools/bcp-utility - https://asec.ahnlab.com/en/61000/ - https://asec.ahnlab.com/en/78944/ - https://www.huntress.com/blog/attacking-mssql-servers - https://www.huntress.com/blog/attacking-mssql-servers-pt-ii - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/ - https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems) date: 2024-08-20 tags: - attack.execution - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcp.exe - OriginalFileName: BCP.exe selection_cli: CommandLine|contains: - ' out ' - ' queryout ' condition: all of selection_* falsepositives: - Legitimate data export operations. level: medium
Near-miss passage: Sigma rule: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.. Logsource: windows / process_creation. Rule: title: File Encryption/Decryption Via Gpg4win From Suspicious Locations id: e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d status: test description: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations. references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-11-30 modified: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Product: GNU Privacy Guard (GnuPG) - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains: -passphrase selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
Matching passage: CVE-2015-4688. CWE: CWE-200. CVSS: 5.300000190734863. Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
Near-miss passage: CVE-2015-3373. CWE: CWE-200. CVSS: 5.0. The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
Query: describe CVE-2015-6320
Matching passage: CVE-2015-6320. CWE: CWE-399. CVSS: 7.5. The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet, aka Bug ID CSCuv63138.
Near-miss passage: CVE-2015-0248. CWE: CWE-399. CVSS: 5.0. The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
Query: describe CVE-2015-8578
Matching passage: CVE-2015-8578. CWE: CWE-264. CVSS: 6.400000095367432. AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Near-miss passage: CVE-2015-2371. CWE: CWE-264. CVSS: 6.900000095367432. The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a custom action script associated with a .msi package, aka "Windows Installer EoP Vulnerability."
Query: rule covering The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule
Matching passage: Sigma rule: The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec PowerShell Obfuscation id: 6f8b3439-a203-45dc-a88b-abf57ea15ccf status: test description: The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule. references: - https://github.com/byt3bl33d3r/CrackMapExec - https://github.com/byt3bl33d3r/CrackMapExec/blob/0a49f75347b625e81ee6aa8c33d3970b5515ea9e/cme/helpers/powershell.py#L242 author: Thomas Patzke date: 2020-05-22 modified: 2023-02-21 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: - join*split - ( $ShellId[1]+$ShellId[13]+'x') - ( $PSHome[*]+$PSHOME[*]+ - ( $env:Public[13]+$env:Public[5]+'x') - ( $env:ComSpec[4,*,25]-Join'') - '[1,3]+''x''-Join'''')' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry store. Logsource: windows / process_creation. Rule: title: Enumeration for Credentials in Registry id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1 status: test description: 'Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: reg: Image|endswith: \reg.exe CommandLine|contains|all: - ' query ' - '/t ' - REG_SZ - /s hive: - CommandLine|contains|all: - '/f ' - HKLM - CommandLine|contains|all: - '/f ' - HKCU - CommandLine|contains: HKCU\Software\SimonTatham\PuTTY\Sessions condition: reg and hive falsepositives: - Unknown level: medium
Query: alert when Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex
Matching passage: Sigma rule: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintex. Logsource: windows / registry_event. Rule: title: Security Support Provider (SSP) Added to LSA Configuration id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc status: test description: 'Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows. ' references: - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/ - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157 author: iwillkeepwatch date: 2019-01-18 modified: 2026-03-30 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.005 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: - \Control\Lsa\Security Packages - \Control\Lsa\OSConfig\Security Packages filter_main_msiexec: Image: - C:\Windows\system32\msiexec.exe - C:\Windows\syswow64\MsiExec.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a. Logsource: windows / process_creation. Rule: title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d related: - id: 236d8e89-ed95-4789-a982-36f4643738ba type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_cli: CommandLine|contains|all: - ' script ' - ' set ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: write Sigma for Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e
Matching passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Near-miss passage: Sigma rule: Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent. Logsource: proxy. Rule: title: Potential Hello-World Scraper Botnet Activity id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5 status: experimental description: 'Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string. ' references: - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 author: Joseph A. M. date: 2025-08-02 tags: - attack.reconnaissance - attack.t1595 logsource: category: proxy detection: selection: c-useragent: Hello-World/1.0 cs-method: GET condition: selection falsepositives: - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent. - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems. level: medium