alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC alert related to Launchctl
Matching passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1569 System Services. Tactics: execution. Description: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.
Query: describe CVE-2015-4877
Matching passage: CVE-2015-4877. CWE: UNKNOWN. CVSS: 1.5. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4878.
Near-miss passage: CVE-2015-4880. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4867.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Near-miss passage: Sigma rule: Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitati. Logsource: windows / file_event. Rule: title: Suspicious File Write to SharePoint Layouts Directory id: 1f0489be-b496-4ddf-b3a9-5900f2044e9c status: experimental description: 'Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770. ' references: - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/ - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-24 tags: - attack.initial-access - attack.t1190 - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \w3wp.exe TargetFilename|startswith: - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\ - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\ TargetFilename|contains: - \15\TEMPLATE\LAYOUTS\ - \16\TEMPLATE\LAYOUTS\ TargetFilename|endswith: - .asax - .ascx - .ashx - .asmx - .asp - .aspx - .bat - .cmd - .cer - .config - .hta - .js - .jsp - .jspx - .php - .ps1 - .vbs condition: selection falsepositives: - Unknown level: high
Query: rule covering Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to
Matching passage: Sigma rule: Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to. Logsource: windows / process_creation. Rule: title: Notepad Password Files Discovery id: 3b4e950b-a3ea-44d3-877e-432071990709 status: experimental description: Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity. references: - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ - https://intel.thedfirreport.com/eventReports/view/57 author: The DFIR Report tags: - attack.discovery - attack.t1083 date: 2025-02-21 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \explorer.exe Image|endswith: \notepad.exe CommandLine|endswith: - password*.txt - password*.csv - password*.doc - password*.xls condition: selection falsepositives: - Legitimate use of opening files from remote hosts by administrators or users. However, storing passwords in text readable format could potentially be a violation of the organization's policy. Any match should be investigated further. level: low
Near-miss passage: Sigma rule: Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access. Logsource: aws / cloudtrail. Rule: title: AWS Key Pair Import Activity id: 92f84194-8d9a-4ee0-8699-c30bfac59780 status: experimental description: 'Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: ImportKeyPair condition: selection falsepositives: - Legitimate administrative actions by authorized users importing keys for valid purposes. - Automated processes for infrastructure setup may trigger this alert. - Verify the user identity, user agent, and source IP address to ensure they are expected. level: medium
Query: exploit filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service
Matching passage: CVE-2015-0217. CWE: CWE-399. CVSS: 6.800000190734863. filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
Near-miss passage: CVE-2015-3961. CWE: CWE-399. CVSS: 3.5. The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.
Query: detect Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. in logs
Matching passage: Sigma rule: Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension.. Logsource: windows / process_creation. Rule: title: File Download From Browser Process Via Inline URL id: 94771a71-ba41-4b6e-a757-b531372eaab6 status: test description: Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state. references: - https://twitter.com/mrd0x/status/1478116126005641220 - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_http: CommandLine|contains: http selection_extensions: - CommandLine|endswith: - .7z - .dat - .dll - .exe - .hta - .ps1 - .psm1 - .txt - .vbe - .vbs - .zip - CommandLine|contains: - .7z" - .dat" - .dll" - .hta" - .ps1" - .psm1" - .txt" - .vbe" - .vbs" - .zip" condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download/info.yml
Near-miss passage: Sigma rule: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files'). Logsource: windows / process_creation. Rule: title: Remote Access Tool - RURAT Execution From Unusual Location id: e01fa958-6893-41d4-ae03-182477c5e77d status: test description: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files') references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2023-03-05 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rutserv.exe - \rfusclient.exe - Product: Remote Utilities filter: Image|startswith: - C:\Program Files\Remote Utilities - C:\Program Files (x86)\Remote Utilities condition: selection and not filter falsepositives: - Unknown level: medium
Query: detection rule: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer
Matching passage: Sigma rule: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer. Logsource: windows / dns_query. Rule: title: TeamViewer Domain Query By Non-TeamViewer Application id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e status: test description: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation) references: - https://www.teamviewer.com/en-us/ author: Florian Roth (Nextron Systems) date: 2022-01-30 modified: 2023-09-18 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: dns_query detection: selection: QueryName: - taf.teamviewer.com - udp.ping.teamviewer.com filter_main_teamviewer: Image|contains: TeamViewer condition: selection and not 1 of filter_main_* falsepositives: - Unknown binary names of TeamViewer - Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications level: medium
Near-miss passage: Sigma rule: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker try. Logsource: windows / registry_delete. Rule: title: Folder Removed From Exploit Guard ProtectedFolders List - Registry id: 272e55a4-9e6b-4211-acb6-78f51f0b1b40 status: test description: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-02-08 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders condition: selection falsepositives: - Legitimate administrators removing applications (should always be investigated) level: high
Query: detection rule: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.
Matching passage: Sigma rule: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.. Logsource: azure / auditlogs. Rule: title: User State Changed From Guest To Member id: 8dee7a0d-43fd-4b3c-8cd1-605e189d195e status: test description: Detects the change of user type from "Guest" to "Member" for potential elevation of privilege. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins author: MikeDuddington, '@dudders1' date: 2022-06-30 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: UserManagement OperationName: Update user properties.message: '"displayName":"UserType","oldValue":"[\"Guest\"]","newValue":"[\"Member\"]"' condition: selection falsepositives: - If this was approved by System Administrator. level: medium
Near-miss passage: Sigma rule: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer. Logsource: windows / dns_query. Rule: title: TeamViewer Domain Query By Non-TeamViewer Application id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e status: test description: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation) references: - https://www.teamviewer.com/en-us/ author: Florian Roth (Nextron Systems) date: 2022-01-30 modified: 2023-09-18 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: dns_query detection: selection: QueryName: - taf.teamviewer.com - udp.ping.teamviewer.com filter_main_teamviewer: Image|contains: TeamViewer condition: selection and not 1 of filter_main_* falsepositives: - Unknown binary names of TeamViewer - Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications level: medium
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a (1) style or (2
Matching passage: CVE-2015-3012. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a (1) style or (2) font name or (3) javascript or (4) data URI.
Near-miss passage: CVE-2015-1053. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.
Query: EDR alert: possible AS-REP Roasting (T1558.004)
Matching passage: T1558.004 AS-REP Roasting. Tactics: credential access. Description: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. (Citation: Harmj0y
Near-miss passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Query: write Sigma for Monitor and alert on conditional access changes.
Matching passage: Sigma rule: Monitor and alert on conditional access changes.. Logsource: azure / auditlogs. Rule: title: New CA Policy by Non-approved Actor id: 0922467f-db53-4348-b7bf-dee8d0d348c6 status: test description: Monitor and alert on conditional access changes. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure author: Corissa Koopmans, '@corissalea' date: 2022-07-18 tags: - attack.privilege-escalation - attack.t1548 logsource: product: azure service: auditlogs detection: selection: properties.message: Add conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Near-miss passage: Sigma rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.. Logsource: windows / security. Rule: title: Startup/Logon Script Added to Group Policy Object id: 123e4e6d-b123-48f8-b261-7214938acaf0 status: test description: 'Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. ' references: - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html author: Elastic, Josh Nickels, Marius Rothenbücher date: 2024-09-06 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 - attack.t1547 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_eventid: EventID: - 5136 - 5145 selection_attributes_main: AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3 selection_attributes_optional: AttributeValue|contains: - 40B6664F-4972-11D1-A7CA-0000F87571E3 - 40B66650-4972-11D1-A7CA-0000F87571E3 selection_share: ShareName|endswith: \SYSVOL RelativeTargetName|endswith: - \scripts.ini - \psscripts.ini AccessList|contains: '%%4417' condition: selection_eventid and (all of selection_attributes_* or selection_share) falsepositives: - Legitimate execution by system administrators. level: medium
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not valid
Matching passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Near-miss passage: CVE-2015-7234. CWE: CWE-20. CVSS: 4.0. The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.
Query: patch priority for CVE-2015-4220
Matching passage: CVE-2015-4220. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq03773.
Near-miss passage: CVE-2015-6416. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479.