alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution. Logsource: windows / ps_module. Rule: title: SyncAppvPublishingServer Bypass Powershell Restriction - PS Module id: fe5ce7eb-dad8-467c-84a9-31ec23bd644a related: - id: fde7929d-8beb-4a4c-b922-be9974671667 type: derived - id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299 type: derived status: test description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions. references: - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: Ensar Şamil, @sblmsrsn, OSCD Community date: 2020-10-05 modified: 2022-12-02 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: SyncAppvPublishingServer.exe condition: selection falsepositives: - App-V clients level: medium
Near-miss passage: Sigma rule: Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundle. Logsource: windows / process_creation. Rule: title: Uncommon Link.EXE Parent Process id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6 status: test description: 'Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious. ' references: - https://twitter.com/0gtweet/status/1560732860935729152 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2024-06-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \link.exe CommandLine|contains: LINK / filter_main_visual_studio: ParentImage|startswith: - C:\Program Files\Microsoft Visual Studio\ - C:\Program Files (x86)\Microsoft Visual Studio\ ParentImage|contains: - \VC\bin\ - \VC\Tools\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defens. Logsource: windows / process_creation. Rule: title: Renamed ProcDump Execution id: 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67 related: - id: 03795938-1387-481b-9f4c-3f6241e604fe type: obsolete status: test description: 'Detects the execution of a renamed ProcDump executable. This often done by attackers or malware in order to evade defensive mechanisms. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2019-11-18 modified: 2026-06-29 tags: - attack.stealth - attack.t1036.003 logsource: product: windows category: process_creation detection: selection_ofn: OriginalFileName: procdump selection_cli_dump_flag: CommandLine|contains|windash: - ' -ma ' - ' -mp ' selection_cli_eula_flag: CommandLine|contains|windash: ' /accepteula' filter_main_known_names: Image|endswith: - \procdump.exe - \procdump64.exe - \procdump64a.exe condition: (selection_ofn or all of selection_cli_*) and not 1 of filter_main_* falsepositives: - Procdump illegally bundled with legitimate software. - Administrators who rename binaries (should be investigated). level: high
Near-miss passage: Sigma rule: Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Ping/Copy Command Combination id: ded2b07a-d12f-4284-9b76-653e37b6c8b0 status: test description: 'Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2023-07-18 modified: 2024-03-06 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_cmd: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_action: CommandLine|contains|all: - ping - 'copy ' selection_cli_1: CommandLine|contains|windash: ' -n ' selection_cli_2: CommandLine|contains|windash: ' -y ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6994
Matching passage: CVE-2015-6994. CWE: CWE-399. CVSS: 7.099999904632568. The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of service via a crafted app.
Near-miss passage: CVE-2015-5963. CWE: CWE-399. CVSS: 5.0. contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
Query: detection rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al
Matching passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setuid Capability Set on a Binary via Setcap Utility id: ed447910-bc30-4575-a598-3a2e49516a7a status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setuid'' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setuid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setuid condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects when a user bypasses the push protection on a secret detected by secret scanning.. Logsource: github / audit. Rule: title: Github Push Protection Bypass Detected id: 02cf536a-cf21-4876-8842-4159c8aee3cc status: test description: Detects when a user bypasses the push protection on a secret detected by secret scanning. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action|contains: secret_scanning_push_protection.bypass condition: selection falsepositives: - Allowed administrative activities. level: low
Query: alert when Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe pro
Matching passage: Sigma rule: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe pro. Logsource: windows / file_event. Rule: title: LSASS Process Memory Dump Creation Via Taskmgr.EXE id: 69ca12af-119d-44ed-b50f-a47af0ebc364 status: test description: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager. author: Swachchhanda Shrawan Poudel date: 2023-10-19 references: - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1 tags: - attack.credential-access - attack.t1003.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - :\Windows\system32\taskmgr.exe - :\Windows\SysWOW64\taskmgr.exe TargetFilename|contains|all: - \AppData\Local\Temp\ - \lsass - .DMP condition: selection falsepositives: - Rare case of troubleshooting by an administrator or support that has to be investigated regardless level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/info.yml
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0673
Matching passage: CVE-2015-0673. CWE: CWE-200. CVSS: 4.0. Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792.
Near-miss passage: CVE-2015-5383. CWE: CWE-200. CVSS: 7.5. Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Query: indicators of Network Share Connection Removal
Matching passage: T1070.005 Network Share Connection Removal. Tactics: stealth. Description: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Near-miss passage: T1070.010 Relocate Malware. Tactics: stealth. Description: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024) Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders. Moving payloads into target directories does not alter the Creation timestamp, thereby evading detection logic reliant on modifications to this artifact (i.e., [Timestomp](https://attack.mitre.org/techniques/T1070/006)).
Query: adversary uses Automated Exfiltration
Matching passage: T1020 Automated Exfiltration. Tactics: exfiltration. Description: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).
Near-miss passage: T1020.001 Traffic Duplication. Tactics: exfiltration. Description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Query: hunt for Application or System Exploitation activity
Matching passage: T1499.004 Application or System Exploitation. Tactics: impact. Description: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Near-miss passage: T1499 Endpoint Denial of Service. Tactics: impact. Description: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014) An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. Botnets are commonly used to conduct DDoS attacks against networks and services. Large
Query: detection rule: Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the tok
Matching passage: Sigma rule: Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the tok. Logsource: azure / riskdetection. Rule: title: SAML Token Issuer Anomaly id: e3393cba-31f0-4207-831e-aef90ab17a8c status: test description: Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1606 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: tokenIssuerAnomaly condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of Python DLL files.. Logsource: windows / image_load. Rule: title: Potential Python DLL SideLoading id: d36f7c12-14a3-4d48-b6b8-774b9c66f44d status: test description: Detects potential DLL sideloading of Python DLL files. references: - https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/ - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/ - https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python author: Swachchhanda Shrawan Poudel date: 2024-10-06 modified: 2025-08-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \python39.dll - \python310.dll - \python311.dll - \python312.dll filter_main_default_install_paths: - ImageLoaded|startswith: - C:\Program Files\Python3 - C:\Program Files (x86)\Python3 - ImageLoaded|contains: \AppData\Local\Programs\Python\Python3 filter_optional_visual_studio: ImageLoaded|startswith: C:\Program Files\Microsoft Visual Studio\ filter_optional_anaconda: ImageLoaded|startswith: C:\ProgramData\Anaconda3\ filter_optional_cpython: ImageLoaded|contains: - \cpython\externals\ - \cpython\PCbuild\ filter_optional_pyinstaller: ImageLoaded|startswith: C:\Users ImageLoaded|contains: \AppData\Local\Temp\_MEI filter_main_legit_signature_details: Product: Python Signed: 'true' Description: Python Company: Python Software Foundation condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate software using Python DLLs level: medium
Query: risk of I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Matching passage: CVE-2015-2984. CWE: CWE-264. CVSS: 5.0. I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Near-miss passage: CVE-2015-4331. CWE: CWE-264. CVSS: 3.5. Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.