alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Persistence mechanism resembling Inhibit System Recovery
Matching passage: T1490 Inhibit System Recovery. Tactics: impact. Description: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom) A number of native Windows utilities have been used by adversaries to disable or delete system recovery features: * <code>vssadmin.exe</code> can be used to delete all volume shadow copies on a system - <code>vssadmin.exe delete shadows /all /quiet</code> * [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - <code>wmic shadowcopy delete</code> * <code>wbadmin.exe</code> can be used to delete the Windows Backup Catalog - <code>wbadmin.exe delete catalog -quiet</code> * <code>bcdedit.exe</code> can be used to disable automatic Windows recovery features by modifying boot configuration data - <code>bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no</code> * <code>REAgentC.exe</code> can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system * <code>diskshadow.exe</code> can be used to delete all volume shadow copies on a system - <code>diskshadow delete shadows all</code> (Citation: Diskshadow) (Citation: Crytox Ransomware) On network devices, adversaries may
Near-miss passage: T1495 Firmware Corruption. Tactics: impact. Description: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards. In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable.(Citation: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs_ukraine) Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485).
Query: exploit The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Matching passage: CVE-2015-7934. CWE: CWE-200. CVSS: 8.600000381469727. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Near-miss passage: CVE-2015-2505. CWE: CWE-200. CVSS: 5.0. Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."
Query: rule covering Detects the use of Jlaive to execute assemblies in a copied PowerShell
Matching passage: Sigma rule: Detects the use of Jlaive to execute assemblies in a copied PowerShell. Logsource: windows / process_creation. Rule: title: HackTool - Jlaive In-Memory Assembly Execution id: 0a99eb3e-1617-41bd-b095-13dc767f3def status: test description: Detects the use of Jlaive to execute assemblies in a copied PowerShell references: - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool - https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) date: 2022-05-24 modified: 2023-02-22 tags: - attack.execution - attack.t1059.003 logsource: product: windows category: process_creation detection: parent_selection: ParentImage|endswith: \cmd.exe ParentCommandLine|endswith: .bat selection1: Image|endswith: \xcopy.exe CommandLine|contains|all: - powershell.exe - .bat.exe selection2: Image|endswith: \xcopy.exe CommandLine|contains|all: - pwsh.exe - .bat.exe selection3: Image|endswith: \attrib.exe CommandLine|contains|all: - +s - +h - .bat.exe condition: parent_selection and (1 of selection*) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.. Logsource: windows / security. Rule: title: Weak Encryption Enabled and Kerberoast id: f6de9536-0441-4b3f-a646-f4e00f300ffd status: test description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking. references: - https://adsecurity.org/?p=2053 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-07-30 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management' detection: selection: EventID: 4738 olduac_des: OldUacValue|endswith: - 8??? - 9??? - A??? - B??? - C??? - D??? - E??? - F??? newuac_des: NewUacValue|endswith: - 8??? - 9??? - A??? - B??? - C??? - D??? - E??? - F??? olduac_preauth: OldUacValue|endswith: - 1???? - 3???? - 5???? - 7???? - 9???? - B???? - D???? - F???? newuac_preauth: NewUacValue|endswith: - 1???? - 3???? - 5???? - 7???? - 9???? - B???? - D???? - F???? olduac_encrypted: OldUacValue|endswith: - 8?? - 9?? - A?? - B?? - C?? - D?? - E?? - F?? newuac_encrypted: NewUacValue|endswith: - 8?? - 9?? - A?? - B?? - C?? - D?? - E?? - F?? condition: selection and ((newuac_des and not olduac_des) or (newuac_preauth and not olduac_preauth) or (newuac_encrypted and not olduac_encrypted)) falsepositives: - Unknown level: high
Query: Sigma rule for Detects possible execution via LNK file accessed on a WebDAV server.
Matching passage: Sigma rule: Detects possible execution via LNK file accessed on a WebDAV server.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious WebDAV LNK Execution id: 1412aa78-a24c-4abd-83df-767dfb2c5bbe related: - id: f0507c0f-a3a2-40f5-acc6-7f543c334993 type: similar status: test description: Detects possible execution via LNK file accessed on a WebDAV server. references: - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462 author: Micah Babinski date: 2023-08-21 tags: - attack.execution - attack.t1059.001 - attack.t1204 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \explorer.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe CommandLine|contains: \DavWWWRoot\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver. Logsource: windows / system. Rule: title: RTCore Suspicious Service Installation id: 91c49341-e2ef-40c0-ac45-49ec5c3fe26c status: test description: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse references: - https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-30 tags: - attack.persistence logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: RTCore64 condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh
Matching passage: Sigma rule: Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing wh. Logsource: windows / registry_set. Rule: title: Python Function Execution Security Warning Disabled In Excel - Registry id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44 related: - id: 023c654f-8f16-44d9-bb2b-00ff36a62af9 type: similar status: test description: 'Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet. ' references: - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 author: Nasreddine Bencherchali (Nextron Systems), @Kostastsale date: 2024-08-23 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Office\ TargetObject|endswith: \Excel\Security\PythonFunctionWarnings Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects audio capture via PowerShell Cmdlet.. Logsource: windows / process_creation. Rule: title: Audio Capture via PowerShell id: 932fb0d8-692b-4b0f-a26e-5643a50fe7d6 status: test description: Detects audio capture via PowerShell Cmdlet. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md - https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html - https://github.com/frgnca/AudioDeviceCmdlets author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-04-06 tags: - attack.collection - attack.t1123 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - WindowsAudioDevice-Powershell-Cmdlet - Toggle-AudioDevice - 'Get-AudioDevice ' - 'Set-AudioDevice ' - 'Write-AudioDevice ' condition: selection falsepositives: - Legitimate audio capture by legitimate user. level: medium
Query: risk of Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability.
Matching passage: CVE-2015-2483. CWE: CWE-200. CVSS: 5.0. Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5959. CWE: CWE-200. CVSS: 9.800000190734863. Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.
Query: exploit cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharac
Matching passage: CVE-2015-4336. CWE: CWE-77. CVSS: 6.5. cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Near-miss passage: CVE-2015-3678. CWE: CWE-77. CVSS: 7.199999809265137. AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.
Matching passage: CVE-2015-5564. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, and CVE-2015-5565.
Near-miss passage: CVE-2015-6491. CWE: UNKNOWN. CVSS: 4.0. Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors.
Query: Sigma YAML for bitbucket / audit
Matching passage: Sigma rule: Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure id: 70ed1d26-0050-4b38-a599-92c53d57d45a status: test description: 'Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Near-miss passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy". Logsource: windows / ps_script. Rule: title: Change PowerShell Policies to an Insecure Level - PowerShell id: 61d0475c-173f-4844-86f7-f3eebae1c66b related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 author: frack113 date: 2021-10-20 modified: 2023-12-14 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: Set-ExecutionPolicy selection_option: ScriptBlockText|contains: - Unrestricted - bypass filter_optional_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1') - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Administrator script level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can. Logsource: windows / process_creation. Rule: title: Suspicious Csi.exe Usage id: 40b95d31-1afc-469e-8d34-9a3a667d058e status: test description: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/ - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/ - https://twitter.com/Z3Jpa29z/status/1317545798981324801 author: Konstantin Grishchenko, oscd.community date: 2020-10-17 modified: 2022-07-11 tags: - attack.lateral-movement - attack.execution - attack.stealth - attack.t1072 - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \csi.exe - \rcsi.exe - OriginalFileName: - csi.exe - rcsi.exe selection_cli: Company: Microsoft Corporation condition: all of selection* falsepositives: - Legitimate usage by software developers level: medium
Near-miss passage: Sigma rule: Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity. Logsource: windows / process_creation. Rule: title: Suspicious Kerberos Ticket Request via CLI id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 related: - id: a861d835-af37-4930-bcd6-5b178bfb54df type: similar status: experimental description: 'Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. ' references: - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_cli: CommandLine|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: all of selection_* falsepositives: - Legitimate command line usage by administrators or security tools. level: high
Query: detect Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se in logs
Matching passage: Sigma rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se. Logsource: windows / registry_set. Rule: title: MaxMpxCt Registry Value Changed id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e status: test description: 'Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic. ' references: - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-19 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Identifies when a device or device configuration in azure is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Device or Configuration Modified or Deleted id: 46530378-f9db-4af9-a9e5-889c177d3881 status: test description: Identifies when a device or device configuration in azure is modified or deleted. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2022-10-09 tags: - attack.impact - attack.t1485 - attack.t1565.001 logsource: product: azure service: activitylogs detection: selection: properties.message: - Delete device - Delete device configuration - Update device - Update device configuration condition: selection falsepositives: - Device or device configuration being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: vulnerability: Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial o
Matching passage: CVE-2015-5291. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
Near-miss passage: CVE-2015-2447. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2446.