alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the use of grep to discover specific files created by the GobRAT malware
Matching passage: Sigma rule: Detects the use of grep to discover specific files created by the GobRAT malware. Logsource: linux / process_creation. Rule: title: Potential GobRAT File Discovery Via Grep id: e34cfa0c-0a50-4210-9cb3-5632d08eb041 status: test description: Detects the use of grep to discover specific files created by the GobRAT malware references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: linux detection: selection: Image|endswith: /grep CommandLine|contains: - apached - frpc - sshd.sh - zone.arm condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential PowerShell commands or code within registry run keys. Logsource: windows / registry_set. Rule: title: Suspicious PowerShell In Registry Run Keys id: 8d85cf08-bf97-4260-ba49-986a2a65129c status: test description: Detects potential PowerShell commands or code within registry run keys references: - https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: frack113, Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Details|contains: - powershell - 'pwsh ' - FromBase64String - .DownloadFile( - .DownloadString( - ' -w hidden ' - ' -w 1 ' - -windowstyle hidden - -window hidden - ' -nop ' - ' -encodedcommand ' - -ExecutionPolicy Bypass - Invoke-Expression - IEX ( - Invoke-Command - ICM - - Invoke-WebRequest - 'IWR ' - Invoke-RestMethod - 'IRM ' - ' -noni ' - ' -noninteractive ' condition: selection falsepositives: - Legitimate admin or third party scripts. Baseline according to your environment level: medium
Query: write Sigma for Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t
Matching passage: Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: zeek / dns. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network id: 5588576c-5898-4fac-bcdd-7475a60e8f43 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dns detection: selection: query|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Query: indicators of Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: write Sigma for Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task
Matching passage: Sigma rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task. Logsource: windows / process_creation. Rule: title: Discovery of a System Time id: b243b280-65fe-48df-ba07-6ddea7646427 status: test description: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. references: - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-06-28 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_time: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: time selection_w32tm: Image|endswith: \w32tm.exe CommandLine|contains: tz condition: 1 of selection_* falsepositives: - Legitimate use of the system utilities to discover system time for legitimate reason level: low
Near-miss passage: Sigma rule: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malici. Logsource: windows / ps_script. Rule: title: Powershell Create Scheduled Task id: 363eccc0-279a-4ccf-a3ab-24c2e63b11fb status: test description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task author: frack113 date: 2021-12-28 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: - New-ScheduledTaskAction - New-ScheduledTaskTrigger - New-ScheduledTaskPrincipal - New-ScheduledTaskSettingsSet - New-ScheduledTask - Register-ScheduledTask selection_cimmethod: ScriptBlockText|contains|all: - Invoke-CimMethod - -ClassName - PS_ScheduledTask - -NameSpace - Root\Microsoft\Windows\TaskScheduler filter_main_legitimate_scripts: ScriptBlockText|contains|all: - Microsoft.PowerShell.Core\Export-ModuleMember - Microsoft.Management.Infrastructure.CimInstance - __cmdletization_methodParameter condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107862.
Matching passage: CVE-2015-7433. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107862.
Near-miss passage: CVE-2015-7470. CWE: CWE-200. CVSS: 7.5. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as demonstrated by login information.
Query: CVE similar to CVE-2015-9291
Matching passage: CVE-2015-9291. CWE: CWE-284. CVSS: 7.5. cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
Near-miss passage: CVE-2015-1336. CWE: CWE-284. CVSS: 7.800000190734863. The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Query: secure coding against Passing Mutable Objects to an Untrusted Method
Matching passage: CWE-374 Passing Mutable Objects to an Untrusted Method. The product sends non-cloned mutable data as an argument to a method or function.
Near-miss passage: CWE-1069 Empty Exception Block. An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
Query: CVE similar to CVE-2015-9046
Matching passage: CVE-2015-9046. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Near-miss passage: CVE-2015-8735. CWE: CWE-20. CVSS: 5.5. The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.
Query: alert when Identifies when a network security configuration is modified or deleted.
Matching passage: Sigma rule: Identifies when a network security configuration is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Security Configuration Modified or Deleted id: d22b4df4-5a67-4859-a578-8c9a0b5af9df status: test description: Identifies when a network security configuration is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/JOIN/ACTION - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE condition: selection falsepositives: - Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group. Logsource: windows / process_creation. Rule: title: Renamed Jusched.EXE Execution id: edd8a48c-1b9f-4ba1-83aa-490338cd1ccb status: test description: Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group references: - https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf author: Markus Neis, Swisscom date: 2019-06-04 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: Description: - Java Update Scheduler - Java(TM) Update Scheduler filter: Image|endswith: \jusched.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: vulnerability: Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows local users to affect confidentia
Matching passage: CVE-2015-4874. CWE: UNKNOWN. CVSS: 4.099999904632568. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen.
Near-miss passage: CVE-2015-5418. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2877.
Query: describe CVE-2015-1106
Matching passage: CVE-2015-1106. CWE: CWE-200. CVSS: 2.0999999046325684. The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard.
Near-miss passage: CVE-2015-4033. CWE: CWE-200. CVSS: 3.299999952316284. Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Query: rule covering Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Matching passage: Sigma rule: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".. Logsource: windows / registry_set. Rule: title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 related: - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c type: similar - id: f9999590-1f94-4a34-a91e-951e47bedefd type: similar - id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 type: similar status: test description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/ - https://twitter.com/0gtweet/status/1674399582162153472 author: Swachchhanda Shrawan Poudel date: 2023-08-02 modified: 2023-08-17 tags: - attack.stealth - attack.t1218 logsource: category: registry_set product: windows definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored' detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Provisioning\Commands\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential revers. Logsource: linux / process_creation. Rule: title: Python Reverse Shell Execution Via PTY And Socket Modules id: 32e62bc7-3de0-4bb1-90af-532978fe42c0 related: - id: c4042d54-110d-45dd-a0e1-05c47822c937 type: similar status: test description: 'Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell. ' references: - https://www.revshells.com/ author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-24 modified: 2024-11-04 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: python CommandLine|contains|all: - ' -c ' - import - pty - socket - spawn - .connect condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / dns_query
Matching passage: Sigma rule: Detects DNS queries for subdomains related to MEGA sharing website. Logsource: windows / dns_query. Rule: title: DNS Query To MEGA Hosting Website id: 613c03ba-0779-4a53-8a1f-47f914a4ded3 related: - id: 66474410-b883-415f-9f8d-75345a0a66a6 type: similar status: test description: Detects DNS queries for subdomains related to MEGA sharing website references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ author: Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-26 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: userstorage.mega.co.nz condition: selection falsepositives: - Legitimate DNS queries and usage of Mega level: medium
Near-miss passage: Sigma rule: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.. Logsource: windows / process_creation. Rule: title: AspNetCompiler Execution id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar status: test description: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: frack113 date: 2021-11-24 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe condition: selection falsepositives: - Unknown level: medium