alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Monitor and alert on conditional access changes.
Matching passage: Sigma rule: Monitor and alert on conditional access changes.. Logsource: azure / auditlogs. Rule: title: New CA Policy by Non-approved Actor id: 0922467f-db53-4348-b7bf-dee8d0d348c6 status: test description: Monitor and alert on conditional access changes. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure author: Corissa Koopmans, '@corissalea' date: 2022-07-18 tags: - attack.privilege-escalation - attack.t1548 logsource: product: azure service: auditlogs detection: selection: properties.message: Add conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Near-miss passage: Sigma rule: Detects email exfiltration via powershell cmdlets. Logsource: windows / process_creation. Rule: title: Email Exifiltration Via Powershell id: 312d0384-401c-4b8b-abdf-685ffba9a332 status: test description: Detects email exfiltration via powershell cmdlets references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml author: Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea) date: 2022-09-09 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Add-PSSnapin - Get-Recipient - -ExpandProperty - EmailAddresses - SmtpAddress - -hidetableheaders condition: selection falsepositives: - Unknown level: high
Query: detection rule: Detects when an end user consents to an application
Matching passage: Sigma rule: Detects when an end user consents to an application. Logsource: azure / auditlogs. Rule: title: End User Consent id: 9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a status: test description: Detects when an end user consents to an application references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: ConsentContext.IsAdminConsent: 'false' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for la. Logsource: macos / process_creation. Rule: title: Local System Accounts Discovery - MacOs id: ddf36b67-e872-4507-ab2e-46bda21b842c status: test description: 'Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md - https://ss64.com/osx/dscl.html - https://ss64.com/mac/dscacheutil.html author: Alejandro Ortuno, oscd.community date: 2020-10-08 modified: 2026-07-07 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: macos detection: selection_dscl: Image|endswith: /dscl CommandLine|contains|all: - list - /users selection_dscacheutil: Image|endswith: /dscacheutil CommandLine|contains|all: - -q - user selection_root: CommandLine|contains: '''*:0:''' selection_passwd_sudo: Image|endswith: - /cat - /awk - /grep CommandLine|contains: - /etc/passwd - /etc/sudoers selection_id: Image|endswith: /id selection_lsof: Image|endswith: /lsof CommandLine|contains: -u selection_logged_in_users: Image|endswith: - /who - /w - /users - /last selection_home_dir_listing: Image|endswith: /ls CommandLine|endswith: - /Users - /Users' - /Users" selection_loginwindow_prefs: Image|endswith: - /defaults - /plutil CommandLine|contains: com.apple.loginwindow condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Query: secure coding against Reliance on IP Address for Authentication
Matching passage: CWE-291 Reliance on IP Address for Authentication. The product uses an IP address for authentication.
Near-miss passage: CWE-105 Struts: Form Field Without Validator. The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
Query: explain T1499.004 Application or System Exploitation
Matching passage: T1499.004 Application or System Exploitation. Tactics: impact. Description: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Near-miss passage: T1499.003 Application Exhaustion Flood. Tactics: impact. Description: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Query: exploit Cross-site request forgery (CSRF) vulnerability in Cisco Emergency Responder 10.5(1) and 10.5(1a) allows remote attackers to hijack the authentication of arbitrary users, aka Bug I
Matching passage: CVE-2015-6405. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Emergency Responder 10.5(1) and 10.5(1a) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv26501.
Near-miss passage: CVE-2015-9322. CWE: CWE-352. CVSS: 8.800000190734863. The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Query: CVE similar to CVE-2015-1106
Matching passage: CVE-2015-1106. CWE: CWE-200. CVSS: 2.0999999046325684. The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard.
Near-miss passage: CVE-2015-4033. CWE: CWE-200. CVSS: 3.299999952316284. Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Query: describe CVE-2015-5930
Matching passage: CVE-2015-5930. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Near-miss passage: CVE-2015-7221. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.
Query: write Sigma for Download or Copy file with Extrac32
Matching passage: Sigma rule: Download or Copy file with Extrac32. Logsource: windows / process_creation. Rule: title: Suspicious Extrac32 Execution id: aa8e035d-7be4-48d3-a944-102aec04400d status: test description: Download or Copy file with Extrac32 references: - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_lolbas: - CommandLine|contains: extrac32.exe - Image|endswith: \extrac32.exe - OriginalFileName: extrac32.exe selection_archive: CommandLine|contains: .cab selection_options: CommandLine|contains: - /C - /Y - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change m. Logsource: windows / registry_set. Rule: title: New Netsh Helper DLL Registered From A Suspicious Location id: e7b18879-676e-4a0e-ae18-27039185a8e7 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: c90362e0-2df3-4e61-94fe-b37615814cb1 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-11-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: \SOFTWARE\Microsoft\NetSh selection_folders_1: Details|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Temporary Internet selection_folders_2: - Details|contains|all: - :\Users\ - \Favorites\ - Details|contains|all: - :\Users\ - \Favourites\ - Details|contains|all: - :\Users\ - \Contacts\ - Details|contains|all: - :\Users\ - \Pictures\ condition: selection_target and 1 of selection_folders_* falsepositives: - Unknown level: high
Query: Sigma rule for Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indi
Matching passage: Sigma rule: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indi. Logsource: windows / process_creation. Rule: title: Conhost Spawned By Uncommon Parent Process id: cbb9e3d1-2386-4e59-912e-62f1484f7a89 status: test description: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. references: - https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html author: Tim Rauch, Elastic (idea) date: 2022-09-28 modified: 2025-03-06 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \conhost.exe ParentImage|endswith: - \explorer.exe - \lsass.exe - \regsvr32.exe - \rundll32.exe - \services.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \userinit.exe - \wininit.exe - \winlogon.exe filter_main_svchost: ParentCommandLine|contains: - -k apphost -s AppHostSvc - -k imgsvc - -k localService -p -s RemoteRegistry - -k LocalSystemNetworkRestricted -p -s NgcSvc - -k NetSvcs -p -s NcaSvc - -k netsvcs -p -s NetSetupSvc - -k netsvcs -p -s wlidsvc - -k NetworkService -p -s DoSvc - -k wsappx -p -s AppXSvc - -k wsappx -p -s ClipSVC - -k wusvcs -p -s WaaSMedicSvc filter_optional_dropbox: ParentCommandLine|contains: - C:\Program Files (x86)\Dropbox\Client\ - C:\Program Files\Dropbox\Client\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers. Logsource: windows / system. Rule: title: Mesh Agent Service Installation id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc status: test description: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: MeshAgent.exe - ServiceName|contains: Mesh Agent condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Query: risk of NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by r
Matching passage: CVE-2015-1109. CWE: CWE-200. CVSS: 2.0999999046325684. NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by reading a log file.
Near-miss passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Query: adversary uses Winlogon Helper DLL
Matching passage: T1547.004 Winlogon Helper DLL. Tactics: persistence, privilege escalation. Description: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in <code>HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> and <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013) * Winlogon\Notify - points to notification package DLLs that handle Winlogon events * Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on * Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.
Near-miss passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Query: exploit Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause
Matching passage: CVE-2015-0815. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5555. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5558, and CVE-2015-5562.
Query: write Sigma for Detects the execution of SecurityXploded Tools
Matching passage: Sigma rule: Detects the execution of SecurityXploded Tools. Logsource: windows / process_creation. Rule: title: HackTool - SecurityXploded Execution id: 7679d464-4f74-45e2-9e01-ac66c5eb041a status: stable description: Detects the execution of SecurityXploded Tools references: - https://securityxploded.com/ - https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/ author: Florian Roth (Nextron Systems) date: 2018-12-19 modified: 2023-02-04 tags: - attack.credential-access - attack.t1555 logsource: category: process_creation product: windows detection: selection: - Company: SecurityXploded - Image|endswith: PasswordDump.exe - OriginalFileName|endswith: PasswordDump.exe condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" whic. Logsource: windows / process_creation. Rule: title: Potential Regsvr32 Commandline Flag Anomaly id: b236190c-1c61-41e9-84b3-3fe03f6d76b0 status: test description: Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon. references: - https://twitter.com/sbousseaden/status/1282441816986484737?s=12 author: Florian Roth (Nextron Systems) date: 2019-07-13 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: Image|endswith: \regsvr32.exe CommandLine|contains|windash: ' -i:' filter_main_flag: CommandLine|contains|windash: ' -n ' condition: selection and not 1 of filter_main_* falsepositives: - Administrator typo might cause some false positives level: medium
Query: CVE similar to CVE-2015-5530
Matching passage: CVE-2015-5530. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/.
Near-miss passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: describe CVE-2015-8284
Matching passage: CVE-2015-8284. CWE: CWE-284. CVSS: 8.800000190734863. SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
Near-miss passage: CVE-2015-4649. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
Query: exploit Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors
Matching passage: CVE-2015-2958. CWE: CWE-264. CVSS: 6.400000095367432. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and modify settings via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2953.
Near-miss passage: CVE-2015-0801. CWE: CWE-264. CVSS: 7.5. Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
Query: describe CVE-2015-5049
Matching passage: CVE-2015-5049. CWE: CWE-89. CVSS: 5.400000095367432. SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1616. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated ePO users to execute arbitrary SQL commands via unspecified vectors.