alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects use of Cobalt Strike commands accidentally entered in the CMD shell in logs
Matching passage: Sigma rule: Detects use of Cobalt Strike commands accidentally entered in the CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Commands id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 related: - id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 type: similar status: test description: Detects use of Cobalt Strike commands accidentally entered in the CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 - stp.1u logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|startswith: - 'cmd ' - cmd.exe - c:\windows\system32\cmd.exe CommandLine|contains: - psinject - spawnas - make_token - remote-exec - rev2self - dcsync - logonpasswords - execute-assembly - getsystem condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential revers. Logsource: linux / process_creation. Rule: title: Python Reverse Shell Execution Via PTY And Socket Modules id: 32e62bc7-3de0-4bb1-90af-532978fe42c0 related: - id: c4042d54-110d-45dd-a0e1-05c47822c937 type: similar status: test description: 'Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell. ' references: - https://www.revshells.com/ author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-24 modified: 2024-11-04 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: python CommandLine|contains|all: - ' -c ' - import - pty - socket - spawn - .connect condition: selection falsepositives: - Unknown level: high
Query: vulnerability: The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and R
Matching passage: CVE-2015-3335. CWE: CWE-264. CVSS: 7.5. The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Near-miss passage: CVE-2015-6745. CWE: CWE-264. CVSS: 4.599999904632568. Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
Query: explain CWE-916
Matching passage: CWE-916 Use of Password Hash With Insufficient Computational Effort. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
Near-miss passage: CWE-1115 Source Code Element without Standard Prologue. The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.
Query: telemetry for T1668
Matching passage: T1668 Exclusive Control. Tactics: persistence. Description: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system(Citation: Mandiant-iab-control)(Citation: CERT AT Fortinent Ransomware 2025) to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services(Citation: sophos-multiple-attackers), stripping privileges from accounts(Citation: aquasec-postgres-processes), or removing other malware already on the compromised device.(Citation: fsecure-netsky) Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of [Resource Hijacking](https://attack.mitre.org/techniques/T1496), leveraging a compromised device’s full power allows the threat actor to maximize profit.(Citation: sophos-multiple-attackers)
Near-miss passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: weakness Reliance on HTTP instead of HTTPS
Matching passage: CWE-1428 Reliance on HTTP instead of HTTPS. The product provides or relies on use of HTTP communications when HTTPS is available.
Near-miss passage: CWE-278 Insecure Preserved Inherited Permissions. A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
Query: exfiltration using Exfiltration to Cloud Storage
Matching passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Near-miss passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Query: common weakness: Path Traversal: '....//'
Matching passage: CWE-34 Path Traversal: '....//'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-278 Insecure Preserved Inherited Permissions. A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
Query: describe CVE-2015-1276
Matching passage: CVE-2015-1276. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
Near-miss passage: CVE-2015-1220. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size in a GIF image.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 
Matching passage: CVE-2015-3106. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
Near-miss passage: CVE-2015-4492. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.
Query: risk of The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and 
Matching passage: CVE-2015-1596. CWE: CWE-310. CVSS: 5.800000190734863. The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-8329. CWE: CWE-310. CVSS: 5.0. SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Query: vulnerability: The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, dat
Matching passage: CVE-2015-4490. CWE: CWE-79. CVSS: 4.300000190734863. The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.
Near-miss passage: CVE-2015-8755. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Query: rule covering Detects potential DLL sideloading using comctl32.dll to obtain system privileges
Matching passage: Sigma rule: Detects potential DLL sideloading using comctl32.dll to obtain system privileges. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via comctl32.dll id: 6360757a-d460-456c-8b13-74cf0e60cceb status: test description: Detects potential DLL sideloading using comctl32.dll to obtain system privileges references: - https://github.com/binderlabs/DirCreate2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash) date: 2022-12-16 modified: 2022-12-19 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|startswith: - C:\Windows\System32\logonUI.exe.local\ - C:\Windows\System32\werFault.exe.local\ - C:\Windows\System32\consent.exe.local\ - C:\Windows\System32\narrator.exe.local\ - C:\windows\system32\wermgr.exe.local\ ImageLoaded|endswith: \comctl32.dll condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by. Logsource: windows / process_creation. Rule: title: Boot Configuration Tampering Via Bcdedit.EXE id: 1444443e-6757-43e4-9ea4-c8fc705f79a2 status: stable description: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_set: CommandLine|contains: set selection_cli: - CommandLine|contains|all: - bootstatuspolicy - ignoreallfailures - CommandLine|contains|all: - recoveryenabled - 'no' condition: all of selection_* falsepositives: - Unlikely level: high simulation: - type: atomic-red-team name: Windows - Disable Windows Recovery Console Repair technique: T1490 atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81
Query: Sigma YAML for github / audit
Matching passage: Sigma rule: Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could. Logsource: github / audit. Rule: title: GitHub Repository Pages Site Changed to Public id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55 status: experimental description: 'Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code. ' references: - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.collection - attack.exfiltration - attack.t1567.001 logsource: product: github service: audit detection: selection: action: repo.pages_public condition: selection falsepositives: - Legitimate publishing of repository pages by authorized users level: low
Near-miss passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation. Logsource: windows / security. Rule: title: Meterpreter or Cobalt Strike Getsystem Service Installation - Security id: ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34 related: - id: 843544a7-56e0-4dcc-a44f-5cc266dd97d6 type: derived status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems) date: 2019-10-26 modified: 2023-11-15 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_cli_cmd: ServiceFileName|contains|all: - /c - echo - \pipe\ ServiceFileName|contains: - cmd - '%COMSPEC%' selection_cli_rundll: ServiceFileName|contains|all: - rundll32 - .dll,a - '/p:' selection_cli_share: ServiceFileName|startswith: \\\\127.0.0.1\\ADMIN$\ condition: selection_eid and 1 of selection_cli_* falsepositives: - Unlikely level: high
Query: Sigma rule for Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Matching passage: Sigma rule: Detects when an attacker tries to hide from Sysmon by disabling or stopping it. Logsource: windows / sysmon_status. Rule: title: Sysmon Configuration Modification id: 1f2b5353-573f-4880-8e33-7d04dcf97744 status: test description: Detects when an attacker tries to hide from Sysmon by disabling or stopping it references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html author: frack113 date: 2021-06-04 modified: 2022-08-02 tags: - attack.stealth - attack.t1564 logsource: product: windows category: sysmon_status detection: selection_stop: State: Stopped selection_conf: - Sysmon config state changed filter: State: Started condition: 1 of selection_* and not filter falsepositives: - Legitimate administrative action level: high
Near-miss passage: Sigma rule: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale. Logsource: windows / security. Rule: title: Persistence and Execution at Scale via GPO Scheduled Task id: a8f29a7b-b137-4446-80a0-b804272f3da2 status: test description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale references: - https://twitter.com/menasec1/status/1106899890377052160 - https://www.secureworks.com/blog/ransomware-as-a-distraction - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-09-04 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.lateral-movement - attack.t1053.005 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_5136: EventID: 5136 AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: - CAB54552-DEEA-4691-817E-ED4A4D1AFC72 - AADCED64-746C-4633-A97C-D61349046527 selection_5145: EventID: 5145 ShareName|endswith: \SYSVOL RelativeTargetName|endswith: ScheduledTasks.xml AccessList|contains: - WriteData - '%%4417' condition: 1 of selection_* falsepositives: - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks. level: high
Query: vulnerability: Open redirect vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to redirect users to arbitrary web sites and con
Matching passage: CVE-2015-7428. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Near-miss passage: CVE-2015-6845. CWE: UNKNOWN. CVSS: 7.5. EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
Query: detection rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Matching passage: Sigma rule: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) id: a58353df-af43-4753-bad0-cd83ef35eef5 related: - id: 2afafd61-6aae-4df4-baed-139fa1f4c345 type: derived status: test description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11) - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-14 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ntdsutil.exe - OriginalFileName: ntdsutil.exe selection_cli: - CommandLine|contains|all: - snapshot - 'mount ' - CommandLine|contains|all: - ac - ' i' - ' ntds' condition: all of selection_* falsepositives: - Legitimate usage to restore snapshots - Legitimate admin activity level: medium
Near-miss passage: Sigma rule: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe. Logsource: windows / dns_query. Rule: title: Cloudflared Tunnels Related DNS Requests id: a1d9eec5-33b2-4177-8d24-27fe754d0812 related: - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 type: similar status: test description: 'Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium