alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: macos / process_creation. Rule: title: System Shutdown/Reboot - MacOs id: 40b1fbe2-18ea-4ee7-be47-0294285811de status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: macos category: process_creation detection: selection: Image|endswith: - /shutdown - /reboot - /halt condition: selection falsepositives: - Legitimate administrative activity level: informational
Near-miss passage: Sigma rule: Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network con. Logsource: linux / process_creation. Rule: title: ESXi Network Configuration Discovery Via ESXCLI id: 33e814e0-1f00-4e43-9c34-31fb7ae2b174 status: test description: Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html author: Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: network selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Query: detection rule: TeamViewer_Desktop.exe is create during install
Matching passage: Sigma rule: TeamViewer_Desktop.exe is create during install. Logsource: windows / file_event. Rule: title: Installation of TeamViewer Desktop id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d status: test description: TeamViewer_Desktop.exe is create during install references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows author: frack113 date: 2022-01-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \TeamViewer_Desktop.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious execution of a Microsoft HTML Help (HH.exe). Logsource: windows / process_creation. Rule: title: Suspicious HH.EXE Execution id: e8a95b5e-c891-46e2-b33a-93937d3abc31 status: test description: Detects a suspicious execution of a Microsoft HTML Help (HH.exe) references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/ - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7 - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Maxim Pavlunin date: 2020-04-01 modified: 2023-04-12 tags: - attack.execution - attack.initial-access - attack.stealth - attack.t1047 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.007 - attack.t1218 - attack.t1218.001 - attack.t1218.010 - attack.t1218.011 - attack.t1566 - attack.t1566.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_paths: CommandLine|contains: - .application - \AppData\Local\Temp\ - \Content.Outlook\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Query: telemetry for T1114
Matching passage: T1114 Email Collection. Tactics: collection. Description: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.
Near-miss passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Query: risk of Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via 
Matching passage: CVE-2015-7368. CWE: CWE-200. CVSS: 2.0999999046325684. Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache.
Near-miss passage: CVE-2015-5832. CWE: CWE-200. CVSS: 2.0999999046325684. The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which might allow physically proximate attackers to obtain sensitive information via unspecified vectors.
Query: risk of Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server A
Matching passage: CVE-2015-2282. CWE: CWE-119. CVSS: 7.5. Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
Near-miss passage: CVE-2015-5131. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.
Query: CVE similar to CVE-2015-1827
Matching passage: CVE-2015-1827. CWE: CWE-19. CVSS: 5.0. The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
Near-miss passage: CVE-2015-5344. CWE: CWE-19. CVSS: 9.800000190734863. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Query: Sigma rule for Detects potential DLL sideloading of "EACore.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "EACore.dll". Logsource: windows / image_load. Rule: title: Potential EACore.DLL Sideloading id: edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5 status: test description: Detects potential DLL sideloading of "EACore.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \EACore.dll filter_main_legit_path: Image|contains|all: - C:\Program Files\Electronic Arts\EA Desktop\ - \EACoreServer.exe ImageLoaded|startswith: C:\Program Files\Electronic Arts\EA Desktop\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects logon events that specify new credentials. Logsource: windows / security. Rule: title: Outgoing Logon with New Credentials id: def8b624-e08f-4ae1-8612-1ba21190da6b status: test description: Detects logon events that specify new credentials references: - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf author: Max Altgelt (Nextron Systems) date: 2022-04-06 tags: - attack.lateral-movement - attack.t1550 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 condition: selection falsepositives: - Legitimate remote administration activity level: low
Query: detection rule: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by m
Matching passage: Sigma rule: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by m. Logsource: windows / process_creation. Rule: title: Greedy File Deletion Using Del id: 204b17ae-4007-471b-917b-b917b315c5db status: test description: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence. references: - https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase author: frack113 , X__Junior (Nextron Systems) date: 2021-12-02 modified: 2023-09-11 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_del: CommandLine|contains: - 'del ' - 'erase ' selection_extensions: CommandLine|contains: - \\\*.au3 - \\\*.dll - \\\*.exe - \\\*.js condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack. Logsource: windows / process_creation. Rule: title: Findstr Launching .lnk File id: 33339be3-148b-4e16-af56-ad16ec6c7e7b status: test description: Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack references: - https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/ author: Trent Liffick date: 2020-05-01 modified: 2024-01-15 tags: - attack.stealth - attack.t1036 - attack.t1202 - attack.t1027.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|endswith: - .lnk - .lnk" - .lnk' condition: all of selection_* falsepositives: - Unknown level: medium
Query: alert when Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command
Matching passage: Sigma rule: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command. Logsource: windows / process_creation. Rule: title: Suspicious Windows Update Agent Empty Cmdline id: 52d097e2-063e-4c9c-8fbb-855c8948d135 status: test description: 'Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn''t contain any command line flags ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-26 modified: 2023-11-11 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Wuauclt.exe - OriginalFileName: Wuauclt.exe selection_cli: CommandLine|endswith: - Wuauclt - Wuauclt.exe condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.. Logsource: windows / openssh. Rule: title: OpenSSH Server Listening On Socket id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 status: test description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket. references: - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH - https://winaero.com/enable-openssh-server-windows-10/ - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: mdecrevoisier date: 2022-10-25 tags: - attack.lateral-movement - attack.t1021.004 logsource: product: windows service: openssh detection: selection: EventID: 4 process: sshd payload|startswith: 'Server listening on ' condition: selection falsepositives: - Legitimate administrator activity level: medium
Query: exploit The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecifie
Matching passage: CVE-2015-5165. CWE: CWE-908. CVSS: 9.300000190734863. The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Near-miss passage: CVE-2015-8390. CWE: CWE-908. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: detection rule: Detects PowerShell execution to set the ACL of a file or a folder
Matching passage: Sigma rule: Detects PowerShell execution to set the ACL of a file or a folder. Logsource: windows / process_creation. Rule: title: PowerShell Script Change Permission Via Set-Acl id: bdeb2cff-af74-4094-8426-724dc937f20a related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell execution to set the ACL of a file or a folder references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cmdlet: CommandLine|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every. Logsource: windows / registry_event. Rule: title: Office Application Startup - Office Test id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c status: test description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started references: - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/ author: omkar72 date: 2020-10-25 modified: 2023-11-08 tags: - attack.persistence - attack.t1137.002 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Software\Microsoft\Office test\Special\Perf condition: selection falsepositives: - Unlikely level: medium
Query: vulnerability: Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confi
Matching passage: CVE-2015-0455. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-6051. CWE: UNKNOWN. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: vulnerability: The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller (IMC) before 2.0(9) allows remote authenticated users to cause a denial of service (IP interface outage
Matching passage: CVE-2015-6399. CWE: CWE-399. CVSS: 6.800000190734863. The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller (IMC) before 2.0(9) allows remote authenticated users to cause a denial of service (IP interface outage) via crafted parameters in an HTTP request, aka Bug ID CSCuv38286.
Near-miss passage: CVE-2015-1625. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1634.
Query: patch priority for CVE-2015-4747
Matching passage: CVE-2015-4747. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7 and 12.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CEP system.
Near-miss passage: CVE-2015-4801. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality via unknown vectors related to Solaris Kernel Zones.
Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects Remote Utilities Host service installation on the target system.. Logsource: windows / system. Rule: title: Remote Utilities Host Service Install id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9 status: test description: Detects Remote Utilities Host service installation on the target system. references: - https://www.remoteutilities.com/support/kb/host-service-won-t-start/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.persistence logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains|all: - \rutserv.exe - -service - ServiceName: Remote Utilities - Host condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation. Logsource: windows / process_creation. Rule: title: Suspicious MSDT Parent Process id: 7a74da6b-ea76-47db-92cc-874ad90df734 status: test description: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ author: Nextron Systems date: 2022-06-01 modified: 2023-02-06 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe - \wsl.exe selection_msdt: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and
Matching passage: CVE-2015-7485. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108626.
Near-miss passage: CVE-2015-1995. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.