alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the restoration of files from the defender quarantine
Matching passage: Sigma rule: Detects the restoration of files from the defender quarantine. Logsource: windows / windefend. Rule: title: Win Defender Restored Quarantine File id: bc92ca75-cd42-4d61-9a37-9d5aa259c88b status: test description: Detects the restoration of files from the defender quarantine references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 1009 condition: selection falsepositives: - Legitimate administrator activity restoring a file level: high
Near-miss passage: Sigma rule: Detects user accept agreement execution in psexec commandline. Logsource: windows / process_creation. Rule: title: Psexec Execution id: 730fc21b-eaff-474b-ad23-90fd265d4988 status: test description: Detects user accept agreement execution in psexec commandline references: - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: omkar72 date: 2020-10-30 modified: 2023-02-28 tags: - attack.execution - attack.lateral-movement - attack.t1569 - attack.t1021 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \psexec.exe - OriginalFileName: psexec.c condition: selection falsepositives: - Administrative scripts. level: medium
Query: detection rule: Detects when a Container Registry is created or deleted.
Matching passage: Sigma rule: Detects when a Container Registry is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Container Registry Created or Deleted id: 93e0ef48-37c8-49ed-a02c-038aab23628e status: test description: Detects when a Container Registry is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE condition: selection falsepositives: - Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects the use of NirCmd tool for command execution as SYSTEM user. Logsource: windows / process_creation. Rule: title: PUA - NirCmd Execution As LOCAL SYSTEM id: d9047477-0359-48c9-b8c7-792cedcdc9c4 status: test description: Detects the use of NirCmd tool for command execution as SYSTEM user references: - https://www.nirsoft.net/utils/nircmd.html - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ - https://www.nirsoft.net/utils/nircmd2.html#using author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' runassystem ' condition: selection falsepositives: - Legitimate use by administrators level: high
Query: detect Detects the execution of a renamed version of the Plink binary in logs
Matching passage: Sigma rule: Detects the execution of a renamed version of the Plink binary. Logsource: windows / process_creation. Rule: title: Renamed Plink Execution id: 1c12727d-02bf-45ff-a9f3-d49806a3cf43 status: test description: Detects the execution of a renamed version of the Plink binary references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-02-03 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: Plink - CommandLine|contains|all: - ' -l forward' - ' -P ' - ' -R ' filter: Image|endswith: \plink.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potentially suspicious child processes of WinRAR.exe.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of WinRAR.EXE id: 146aace8-9bd6-42ba-be7a-0070d8027b76 related: - id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343 type: similar status: test description: Detects potentially suspicious child processes of WinRAR.exe. references: - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-31 tags: - attack.execution - attack.t1203 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \WinRAR.exe selection_binaries: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - mshta.exe - PowerShell.EXE - pwsh.dll - regsvr32.exe - RUNDLL32.EXE - wscript.exe condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-8783
Matching passage: CVE-2015-8783. CWE: CWE-125. CVSS: 6.5. tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image.
Near-miss passage: CVE-2015-7507. CWE: CWE-125. CVSS: 7.5. libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_decode_rle function.
Query: write Sigma for Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects files that have extensions commonly seen while SDelete is used to wipe files.. Logsource: windows / security. Rule: title: Potential Secure Deletion with SDelete id: 39a80702-d7ca-4a83-b776-525b1f86a36d status: test description: Detects files that have extensions commonly seen while SDelete is used to wipe files. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete author: Thomas Patzke date: 2017-06-14 modified: 2024-12-13 tags: - attack.impact - attack.stealth - attack.defense-impairment - attack.t1070.004 - attack.t1027.005 - attack.t1485 - attack.t1553.002 - attack.s0195 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 - 4658 ObjectName|endswith: - .AAA - .ZZZ condition: selection falsepositives: - Legitimate usage of SDelete - Files that are interacted with that have these extensions legitimately level: medium
Query: detect Detects known sensitive file extensions via Zeek in logs
Matching passage: Sigma rule: Detects known sensitive file extensions via Zeek. Logsource: zeek / smb_files. Rule: title: Suspicious Access to Sensitive File Extensions - Zeek id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc related: - id: 91c945bc-2ad1-4799-a591-4d00198a1215 type: derived status: test description: Detects known sensitive file extensions via Zeek references: - Internal Research author: Samir Bousseaden, @neu5ron date: 2020-04-02 modified: 2025-10-17 tags: - attack.collection logsource: product: zeek service: smb_files detection: selection: name|endswith: - .pst - .ost - .msg - .nst - .oab - .edb - .nsf - .bak - .dmp - .kirbi - .rdp condition: selection falsepositives: - Help Desk operator doing backup or re-imaging end user machine or backup software - Users working with these data types or exchanging message files level: medium
Near-miss passage: Sigma rule: Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors an. Logsource: macos / process_creation. Rule: title: System Information Discovery Using System_Profiler id: 4809c683-059b-4935-879d-36835986f8cf status: test description: 'Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes. ' references: - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html - https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf - https://ss64.com/mac/system_profiler.html - https://objective-see.org/blog/blog_0x62.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af author: Stephen Lincoln `@slincoln_aiq` (AttackIQ) date: 2024-01-02 tags: - attack.discovery - attack.stealth - attack.t1082 - attack.t1497.001 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /system_profiler - CommandLine|contains: system_profiler selection_cmd: CommandLine|contains: - SPApplicationsDataType - SPHardwareDataType - SPNetworkDataType - SPUSBDataType condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Query: detection rule: Detects potentially suspicious child processes of "aspnet_compiler.exe".
Matching passage: Sigma rule: Detects potentially suspicious child processes of "aspnet_compiler.exe".. Logsource: windows / process_creation. Rule: title: Suspicious Child Process of AspNetCompiler id: 9ccba514-7cb6-4c5c-b377-700758f2f120 related: - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects potentially suspicious child processes of "aspnet_compiler.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \aspnet_compiler.exe selection_child: - Image|endswith: - \calc.exe - \notepad.exe - Image|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP/FTP Pattern id: 867356ee-9352-41c9-a8f2-1be690d78216 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2023-05-24 modified: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_flag: CommandLine|contains: - ' /i' - ' -i' selection_protocol: CommandLine|contains: - ftp - http condition: all of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action o
Matching passage: CVE-2015-1434. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Near-miss passage: CVE-2015-4426. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5086. CWE: UNKNOWN. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, and CVE-2015-5085.
Near-miss passage: CVE-2015-5932. CWE: UNKNOWN. CVSS: 7.199999809265137. The kernel in Apple OS X before 10.11.1 allows local users to gain privileges by leveraging an unspecified "type confusion" during Mach task processing.
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to
Matching passage: CVE-2015-4861. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-4477. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.
Query: patch priority for CVE-2015-5714
Matching passage: CVE-2015-5714. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
Near-miss passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Query: alert when Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such a
Matching passage: Sigma rule: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such a. Logsource: windows / process_creation. Rule: title: Computer System Reconnaissance Via Wmic.EXE id: 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f status: test description: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-08 modified: 2023-02-14 tags: - attack.discovery - attack.execution - attack.t1047 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: computersystem condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem/info.yml
Near-miss passage: Sigma rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p. Logsource: windows / process_creation. Rule: title: New Capture Session Launched Via DXCap.EXE id: 60f16a96-db70-42eb-8f76-16763e333590 status: test description: 'Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/ - https://twitter.com/harr0ey/status/992008180904419328 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2022-06-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \DXCap.exe - OriginalFileName: DXCap.exe selection_cli: CommandLine|contains: ' -c ' condition: all of selection* falsepositives: - Legitimate execution of dxcap.exe by legitimate user level: medium
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5100. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-6068. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: CVE similar to CVE-2015-4322
Matching passage: CVE-2015-4322. CWE: CWE-264. CVSS: 5.5. Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, aka Bug ID CSCuv65894.
Near-miss passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Query: Suspicious Service Exhaustion Flood execution detected on endpoint
Matching passage: T1499.002 Service Exhaustion Flood. Tactics: impact. Description: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood) Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)
Near-miss passage: T1499.004 Application or System Exploitation. Tactics: impact. Description: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Query: common weakness: Return of Stack Variable Address
Matching passage: CWE-562 Return of Stack Variable Address. A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
Near-miss passage: CWE-585 Empty Synchronized Block. The product contains an empty synchronized block.