alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their na in logs
Matching passage: Sigma rule: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their na. Logsource: windows / process_creation. Rule: title: HackTool - Impacket Tools Execution id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19 status: test description: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives) references: - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-07 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: - Image|contains: - \goldenPac - \karmaSMB - \kintercept - \ntlmrelayx - \rpcdump - \samrdump - \secretsdump - \smbexec - \smbrelayx - \wmiexec - \wmipersist - Image|endswith: - \atexec_windows.exe - \dcomexec_windows.exe - \dpapi_windows.exe - \findDelegation_windows.exe - \GetADUsers_windows.exe - \GetNPUsers_windows.exe - \getPac_windows.exe - \getST_windows.exe - \getTGT_windows.exe - \GetUserSPNs_windows.exe - \ifmap_windows.exe - \mimikatz_windows.exe - \netview_windows.exe - \nmapAnswerMachine_windows.exe - \opdump_windows.exe - \psexec_windows.exe - \rdp_check_windows.exe - \sambaPipe_windows.exe - \smbclient_windows.exe - \smbserver_windows.exe - \sniff_windows.exe - \sniffer_windows.exe - \split_windows.exe - \ticketer_windows.exe condition: selection falsepositives: - Legitimate use of the impacket tools level: high
Near-miss passage: Sigma rule: Detects when a new identity provider is created for Okta.. Logsource: okta / okta. Rule: title: Okta Identity Provider Created id: 969c7590-8c19-4797-8c1b-23155de6e7ac status: test description: Detects when a new identity provider is created for Okta. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.001 logsource: product: okta service: okta detection: selection: eventType: system.idp.lifecycle.create condition: selection falsepositives: - When an admin creates a new, authorised identity provider. level: medium
Query: write Sigma for This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance
Matching passage: Sigma rule: This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance. Logsource: azure / activitylogs. Rule: title: Azure Active Directory Hybrid Health AD FS New Server id: 288a39fc-4914-4831-9ada-270e9dc12cb4 status: test description: 'This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure. ' references: - https://o365blog.com/post/hybridhealthagent/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2023-10-11 tags: - attack.defense-impairment - attack.t1578 logsource: product: azure service: activitylogs detection: selection: CategoryValue: Administrative ResourceProviderValue: Microsoft.ADHybridHealthService ResourceId|contains: AdFederationService OperationNameValue: Microsoft.ADHybridHealthService/services/servicemembers/action condition: selection falsepositives: - Legitimate AD FS servers added to an AAD Health AD FS service instance level: medium
Near-miss passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: Firewall Configuration Discovery Via Netsh.EXE id: 0e4164da-94bc-450d-a7be-a4b176179f1f status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules - https://ss64.com/nt/netsh.html author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-12-07 modified: 2025-10-18 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - netsh - 'show ' - 'firewall ' CommandLine|contains: - 'config ' - 'state ' - 'rule ' - name=all condition: all of selection_* falsepositives: - Administrative activity level: low
Query: playbook for alert: SIEM correlation: execution activity consistent with Container Orchestration Job
Matching passage: Playbook for T1053.007 Container Orchestration Job. 1) Validate alert telemetry against T1053.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers ove
Near-miss passage: Playbook for T1053.005 Scheduled Task. Different response path focused on execution, persistence, privilege escalation.
Query: Encoded PowerShell / command-line abuse matching Confluence
Matching passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.006 Databases. Tactics: collection. Description: Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)
Query: detection rule: Detects suspicious Powershell code that execute COM Objects
Matching passage: Sigma rule: Detects suspicious Powershell code that execute COM Objects. Logsource: windows / ps_script. Rule: title: Suspicious GetTypeFromCLSID ShellExecute id: 8bc063d5-3a3a-4f01-a140-bc15e55e8437 status: test description: Detects suspicious Powershell code that execute COM Objects references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object author: frack113 date: 2022-04-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - ::GetTypeFromCLSID( - .ShellExecute( condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / registry_set. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Registry id: 6597be7b-ac61-4ac8-bef4-d3ec88174853 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Root\InventoryApplicationFile\winsat.exe| TargetObject|endswith: \LowerCaseLongPath Details|startswith: c:\users\ Details|endswith: \appdata\local\temp\system32\winsat.exe condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5262
Matching passage: CVE-2015-5262. CWE: CWE-399. CVSS: 4.300000190734863. http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Near-miss passage: CVE-2015-0743. CWE: CWE-399. CVSS: 5.0. Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Query: vulnerability: NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
Matching passage: CVE-2015-0565. CWE: CWE-119. CVSS: 10.0. NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
Near-miss passage: CVE-2015-2991. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
Query: describe CVE-2015-5413
Matching passage: CVE-2015-5413. CWE: CWE-264. CVSS: 4.0. HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to gain privileges and obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-8966. CWE: CWE-264. CVSS: 7.800000190734863. arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
Query: alert when Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting
Matching passage: Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / process_creation. Rule: title: Windows Recall Feature Enabled Via Reg.EXE id: 817f252c-5143-4dae-b418-48c3e9f63728 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_value: CommandLine|contains|all: - Microsoft\Windows\WindowsAI - DisableAIDataAnalysis selection_action_add: CommandLine|contains: - add - '0' selection_action_delete: CommandLine|contains: delete condition: selection_img and selection_value and 1 of selection_action_* falsepositives: - Legitimate use/activation of Windows Recall level: medium
Near-miss passage: Sigma rule: Potential adversaries accessing the microphone and webcam in an endpoint.. Logsource: windows / security. Rule: title: Processes Accessing the Microphone and Webcam id: 8cd538a4-62d5-4e83-810b-12d41e428d6e status: test description: Potential adversaries accessing the microphone and webcam in an endpoint. references: - https://twitter.com/duzvik/status/1269671601852813320 - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-07 modified: 2021-11-27 tags: - attack.collection - attack.t1123 logsource: product: windows service: security detection: selection: EventID: - 4657 - 4656 - 4663 ObjectName|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged condition: selection falsepositives: - Unknown level: medium
Query: secure coding against Authentication Bypass by Spoofing
Matching passage: CWE-290 Authentication Bypass by Spoofing. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Near-miss passage: CWE-87 Improper Neutralization of Alternate XSS Syntax. The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Query: risk of Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
Matching passage: CVE-2015-7260. CWE: CWE-264. CVSS: 7.800000190734863. Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
Near-miss passage: CVE-2015-6638. CWE: CWE-264. CVSS: 7.800000190734863. The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
Query: vulnerability: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5790. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: write Sigma for Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg
Matching passage: Sigma rule: Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg. Logsource: windows / process_creation. Rule: title: Sensitive File Access Via Volume Shadow Copy Backup id: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d status: test description: 'Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit) ' references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2024-01-18 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy selection_2: CommandLine|contains: - \\NTDS.dit - \\SYSTEM - \\SECURITY condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the addition of a new network route to a route table in AWS.. Logsource: aws / cloudtrail. Rule: title: New Network Route Added id: c803b2ce-c4a2-4836-beae-b112010390b1 status: test description: 'Detects the addition of a new network route to a route table in AWS. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateRoute condition: selection falsepositives: - New VPC Creation requiring setup of a new route table - New subnets added requiring routing setup level: medium
Query: threat report mentioning Dead Drop Resolver
Matching passage: T1102.001 Dead Drop Resolver. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Near-miss passage: T1102 Web Service. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Query: Multiple failed authentications followed by Email Account
Matching passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Near-miss passage: T1087.002 Domain Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as <code>net user /domain</code> and <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including <code>Get-ADUser</code> and <code>Get-ADGroupMember</code> may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022)
Query: CVE similar to CVE-2015-4872
Matching passage: CVE-2015-4872. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.
Near-miss passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.