alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects Baby Shark C2 Framework default communication patterns
Matching passage: Sigma rule: Detects Baby Shark C2 Framework default communication patterns. Logsource: proxy. Rule: title: HackTool - BabyShark Agent Default URL Pattern id: 304810ed-8853-437f-9e36-c4975c3dfd7e status: test description: Detects Baby Shark C2 Framework default communication patterns references: - https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845 author: Florian Roth (Nextron Systems) date: 2021-06-09 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-uri|contains: momyshark\?key= condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via App. Logsource: windows / process_creation. Rule: title: Potential File Download Via MS-AppInstaller Protocol Handler id: 180c7c5c-d64b-4a63-86e9-68910451bc8b related: - id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a type: derived status: test description: 'Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>" ' references: - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ms-appinstaller://?source= - http condition: selection falsepositives: - Unknown level: medium
Query: rule covering Detects changes to the bitbucket audit log configuration.
Matching passage: Sigma rule: Detects changes to the bitbucket audit log configuration.. Logsource: bitbucket / audit. Rule: title: Bitbucket Audit Log Configuration Updated id: 6aa12161-235a-4dfb-9c74-fe08df8d8da1 status: test description: Detects changes to the bitbucket audit log configuration. references: - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Auditing auditType.action: Audit log configuration updated condition: selection falsepositives: - Legitimate user activity. level: medium
Near-miss passage: Sigma rule: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in th. Logsource: azure / riskdetection. Rule: title: Suspicious Browser Activity id: 944f6adb-7a99-4c69-80c1-b712579e93e6 status: test description: Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: suspiciousBrowser condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: detection rule: See what commands are being input into the device by other people, full credentials can be in the history
Matching passage: Sigma rule: See what commands are being input into the device by other people, full credentials can be in the history. Logsource: cisco / aaa. Rule: title: Cisco Show Commands Input id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b status: test description: See what commands are being input into the device by other people, full credentials can be in the history author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.t1552.003 logsource: product: cisco service: aaa detection: keywords: - show history - show history all - show logging condition: keywords falsepositives: - Not commonly run by administrators, especially if remote logging is configured level: medium
Near-miss passage: Sigma rule: Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative. Logsource: windows / process_creation. Rule: title: PUA - CsExec Execution id: d08a2711-ee8b-4323-bdec-b7d85e892b31 status: test description: Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative references: - https://github.com/malcomvetter/CSExec - https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ author: Florian Roth (Nextron Systems) date: 2022-08-22 modified: 2023-02-21 tags: - attack.resource-development - attack.t1587.001 - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \csexec.exe selection_pe: Description: csexec condition: 1 of selection* falsepositives: - Unknown level: high
Query: EDR alert: possible Clear Linux or Mac System Logs (T1685.006)
Matching passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Near-miss passage: T1685.003 Modify or Spoof Tool UI. Tactics: defense impairment. Description: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)
Query: rule covering All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -
Matching passage: Sigma rule: All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -. Logsource: linux / auditd. Rule: title: Bpfdoor TCP Ports Redirect id: 70b4156e-50fc-4523-aa50-c9dddf1993fc status: test description: 'All TCP traffic on particular port from attacker is routed to different port. ex. ''/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only. ' references: - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor author: Rafal Piasecki date: 2022-08-10 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: cmd: type: EXECVE a0|endswith: iptables a1: -t a2: nat keywords: - --to-ports 42 - --to-ports 43 condition: cmd and keywords falsepositives: - Legitimate ports redirect level: medium
Near-miss passage: Sigma rule: Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hos. Logsource: windows / network_connection. Rule: title: Local Network Connection Initiated By Script Interpreter id: 08249dc0-a28d-4555-8ba5-9255a198e08c related: - id: 992a6cae-db6a-43c8-9cec-76d7195c96fc type: derived status: test description: 'Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md author: frack113 date: 2022-08-28 modified: 2024-05-31 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \wscript.exe - \cscript.exe DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection falsepositives: - Legitimate scripts level: medium
Query: detection rule: Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associate
Matching passage: Sigma rule: Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associate. Logsource: linux / process_creation. Rule: title: Vim GTFOBin Abuse - Linux id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea status: test description: 'Detects the use of "vim" and it''s siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/vi/ - https://gtfobins.github.io/gtfobins/vim/ - https://gtfobins.github.io/gtfobins/rvim/ - https://gtfobins.github.io/gtfobins/vimdiff/ author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux date: 2022-12-28 modified: 2026-06-05 tags: - attack.execution - attack.discovery - attack.t1059 - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /rvim - /vi - /vim - /vimdiff CommandLine|contains: - ' --cmd ' - ' -c' selection_cli: CommandLine|contains: - :!/ - :!$ - :!.. - ':lua ' - ':py ' - :shell - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/csh - /bin/ksh - /bin/zsh - /bin/tmux condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidd. Logsource: windows / registry_set. Rule: title: Displaying Hidden Files Feature Disabled id: 5a5152f1-463f-436b-b2f5-8eceb3964b42 status: test description: 'Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry author: frack113 date: 2022-04-02 modified: 2024-03-26 tags: - attack.stealth - attack.t1564.001 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden - \Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: adversary uses Exploitation for Defense Impairment
Matching passage: T1687 Exploitation for Defense Impairment. Tactics: defense impairment. Description: Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity. Adversaries may exploit a system or application vulnerability to directly interfere with defensive mechanisms. Exploitation occurs when an adversary takes advantage of a programming error in software, services, or the operating system to execute adversary-controlled code, often with the goal of weakening or disabling protections. Vulnerabilities may exist in security tools such as antivirus, endpoint detection and response (EDR), firewalls, or other monitoring solutions. Adversaries may use prior reconnaissance or perform discovery activities (e.g., [Software Discovery](https://attack.mitre.org/techniques/T1518)) to identify defensive tools present in an environment and target them for exploitation. Successful exploitation may allow adversaries to terminate security processes, disable protections, bypass enforcement mechanisms, or reduce the effectiveness of defensive controls. In some cases, vulnerabilities in cloud-based or SaaS infrastructure may also be leveraged to bypass built-in security boundaries or disrupt visibility and enforcement across environments.(Citation: Salesforce zero-day in facebook phishing attack)
Near-miss passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Query: write Sigma for Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)
Matching passage: Sigma rule: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59). Logsource: windows / process_creation. Rule: title: UAC Bypass Tools Using ComputerDefaults id: 3c05e90d-7eba-4324-9972-5d7f711a60a8 status: test description: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-31 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 Image: C:\Windows\System32\ComputerDefaults.exe filter: ParentImage|contains: - :\Windows\System32 - :\Program Files condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Usage Of Qemu id: 5fc297ae-25b6-488a-8f25-cc12ac29b744 status: test description: 'Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. ' references: - https://securelist.com/network-tunneling-with-qemu/111803/ - https://www.qemu.org/docs/master/system/invocation.html#hxtool-5 author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR) date: 2024-06-03 tags: - attack.command-and-control - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - -m 1M - -m 2M - -m 3M CommandLine|contains|all: - restrict=off - '-netdev ' - connect= - -nographic filter_main_normal_usecase: CommandLine|contains: - ' -cdrom ' - ' type=virt ' - ' -blockdev ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: vulnerability: Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a craf
Matching passage: CVE-2015-5745. CWE: CWE-120. CVSS: 6.5. Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
Near-miss passage: CVE-2015-10065. CWE: CWE-120. CVSS: 9.800000190734863. A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Query: describe CVE-2015-3284
Matching passage: CVE-2015-3284. CWE: CWE-200. CVSS: 2.0999999046325684. pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands.
Near-miss passage: CVE-2015-7929. CWE: CWE-200. CVSS: 4.300000190734863. eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Query: write Sigma for Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in
Matching passage: Sigma rule: Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in. Logsource: windows / registry_set. Rule: title: Bypass UAC Using SilentCleanup Task id: 724ea201-6514-4f38-9739-e5973c34f49a status: test description: 'Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task - https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/ - https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign author: frack113, Nextron Systems date: 2022-01-06 modified: 2024-01-30 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Environment\windir filter_main_default: Details: '%SystemRoot%' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml simulation: - type: atomic-red-team name: Bypass UAC using SilentCleanup Task technique: T1548.002 atomic_guid: 28104f8a-4ff1-4582-bcf6-699dce156608
Near-miss passage: Sigma rule: Detects execution of shells from a parent process located in a temporary (/tmp) directory. Logsource: linux / process_creation. Rule: title: Shell Execution Of Process Located In Tmp Directory id: 2fade0b6-7423-4835-9d4f-335b39b83867 status: test description: Detects execution of shells from a parent process located in a temporary (/tmp) directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: ParentImage|startswith: /tmp/ Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-3783
Matching passage: CVE-2015-3783. CWE: CWE-119. CVSS: 7.5. SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2327. CWE: CWE-119. CVSS: 7.5. PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.