alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for github / audit
Matching passage: Sigma rule: Detects when a repository or an organization is being transferred to another location.. Logsource: github / audit. Rule: title: Github Repository/Organization Transferred id: 04ad83ef-1a37-4c10-b57a-81092164bf33 status: test description: Detects when a repository or an organization is being transferred to another location. references: - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership - https://docs.github.com/en/migrations - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.persistence - attack.exfiltration - attack.t1020 - attack.t1537 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - migration.create - org.transfer_outgoing - org.transfer - repo.transfer_outgoing condition: selection falsepositives: - Allowed administrative activities. level: medium
Near-miss passage: Sigma rule: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory. Logsource: windows / process_creation. Rule: title: Kernel Memory Dump Via LiveKD id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2 status: test description: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory references: - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/ - https://kb.acronis.com/content/60892 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2024-03-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \livekd.exe - \livekd64.exe - OriginalFileName: livekd.exe selection_cli: CommandLine|contains|windash: ' -m' condition: all of selection_* falsepositives: - Unlikely in production environment level: high
Query: Sigma rule for Detects suspicious processes including shells spawnd from WinRM host process
Matching passage: Sigma rule: Detects suspicious processes including shells spawnd from WinRM host process. Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by WinRM id: 5cc2cda8-f261-4d88-a2de-e9e193c86716 status: test description: Detects suspicious processes including shells spawnd from WinRM host process author: Andreas Hunkeler (@Karneades), Markus Neis references: - Internal Research date: 2021-05-20 modified: 2022-07-14 tags: - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wsmprovhost.exe Image|endswith: - \cmd.exe - \sh.exe - \bash.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \schtasks.exe - \certutil.exe - \whoami.exe - \bitsadmin.exe condition: selection falsepositives: - Legitimate WinRM usage level: high
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Windows Host id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 related: - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: Image: TeamViewer_Desktop.exe ParentImage: TeamViewer_Service.exe CommandLine|endswith: TeamViewer_Desktop.exe --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: patch priority for CVE-2015-5421
Matching passage: CVE-2015-5421. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2881.
Near-miss passage: CVE-2015-0450. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to WebCenter Spaces Application.
Query: patch priority for CVE-2015-6818
Matching passage: CVE-2015-6818. CWE: CWE-17. CVSS: 7.5. The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
Near-miss passage: CVE-2015-1084. CWE: CWE-17. CVSS: 5.0. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
Query: rule covering Detects programs that connect to known malware callback ports based on threat intelligence reports.
Matching passage: Sigma rule: Detects programs that connect to known malware callback ports based on threat intelligence reports.. Logsource: linux / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication - Linux id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376 related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: derived status: test description: 'Detects programs that connect to known malware callback ports based on threat intelligence reports. ' references: - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors author: hasselj date: 2024-05-10 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: linux detection: selection: Initiated: 'true' DestinationPort: - 888 - 999 - 2200 - 2222 - 4000 - 4444 - 6789 - 8531 - 50501 - 51820 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects process dump via legitimate sqldumper.exe binary. Logsource: windows / process_creation. Rule: title: Dumping Process via Sqldumper.exe id: 23ceaf5c-b6f1-4a32-8559-f2ff734be516 status: test description: Detects process dump via legitimate sqldumper.exe binary references: - https://twitter.com/countuponsec/status/910977826853068800 - https://twitter.com/countuponsec/status/910969424215232518 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/ author: Kirill Kiryanov, oscd.community date: 2020-10-08 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sqldumper.exe CommandLine|contains: - '0x0110' - 0x01100:40 condition: selection falsepositives: - Legitimate MSSQL Server actions level: medium
Query: describe CVE-2015-1219
Matching passage: CVE-2015-1219. CWE: CWE-189. CVSS: 7.5. Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.
Near-miss passage: CVE-2015-2810. CWE: CWE-189. CVSS: 7.5. Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord processor, as used in Hwp 2014 VP before 9.1.0.2342, HanWord Viewer 2007 and Viewer 2010 8.5.6.1158, and HwpViewer 2014 VP 9.1.0.2186, allows remote attackers to cause a denial of service (crash) and possibly "influence the program's execution flow" via a document with a large paragraph size, which triggers heap corruption.
Query: actor TTPs: Code Signing Certificates
Matching passage: T1588.003 Code Signing Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.
Near-miss passage: T1588.001 Malware. Tactics: resource development. Description: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
Query: EDR alert: possible Create Account (T1136)
Matching passage: T1136 Create Account. Tactics: persistence. Description: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Near-miss passage: T1136.002 Domain Account. Tactics: persistence. Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8428. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-7296. CWE: UNKNOWN. CVSS: 4.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914.
Query: vulnerability: Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-pa
Matching passage: CVE-2015-0662. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
Near-miss passage: CVE-2015-2126. CWE: CWE-264. CVSS: 7.199999809265137. Unspecified vulnerability in pppoec in HP HP-UX 11iv2 and 11iv3 allows local users to gain privileges by leveraging setuid permissions.
Query: CWE for Off-by-one Error
Matching passage: CWE-193 Off-by-one Error. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Near-miss passage: CWE-298 Improper Validation of Certificate Expiration. A certificate expiration is not validated or is incorrectly validated.
Query: alert when Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for
Matching passage: Sigma rule: Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for. Logsource: windows / process_creation. Rule: title: PUA - NimScan Execution id: 4fd6b1c7-19b8-4488-97f6-00f0924991a3 status: test description: 'Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool. ' references: - https://x.com/cyberfeeddigest/status/1887041526397587859 - https://github.com/elddy/NimScan author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \NimScan.exe - Hashes|contains: - IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C - IMPHASH=B1B6ADACB172795480179EFD18A29549 - IMPHASH=0D1F896DC7642AD8384F9042F30279C2 condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This d. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using New-ComplianceSearchAction id: 6897cd82-6664-11ed-9022-0242ac120002 related: - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 type: similar status: test description: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud. references: - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps author: Nikita Khalimonenkov date: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter Payload|contains|all: - New-ComplianceSearchAction - Export - pst condition: selection falsepositives: - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored. level: medium
Query: common weakness: Incorrect Chaining or Granularity of Debug Components
Matching passage: CWE-1296 Incorrect Chaining or Granularity of Debug Components. The product's debug components contain incorrect chaining or granularity of debug components.
Near-miss passage: CWE-1113 Inappropriate Comment Style. The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
Query: rule covering Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Matching passage: Sigma rule: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.. Logsource: azure / activitylogs. Rule: title: Azure Suppression Rule Created id: 92cc3e5d-eb57-419d-8c16-5c63f325a401 status: test description: Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE condition: selection falsepositives: - Suppression Rule being created may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.. Logsource: windows / file_access. Rule: title: Microsoft Teams Sensitive File Access By Uncommon Applications id: 65744385-8541-44a6-8630-ffc824d7d4cc status: test description: 'Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process. ' references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2024-07-22 tags: - attack.credential-access - attack.t1528 logsource: product: windows category: file_access definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter_main_legit_location: Image|endswith: \Microsoft\Teams\current\Teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: alert when Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Erro
Matching passage: Sigma rule: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Erro. Logsource: windows / process_creation. Rule: title: Potential Credential Dumping Via WER id: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3 status: test description: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash , Nasreddine Bencherchali' date: 2022-12-08 modified: 2022-12-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \Werfault.exe - OriginalFileName: WerFault.exe selection_cli: ParentUser|contains: - AUTHORI - AUTORI User|contains: - AUTHORI - AUTORI CommandLine|contains|all: - ' -u -p ' - ' -ip ' - ' -s ' filter_lsass: ParentImage: C:\Windows\System32\lsass.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the "-p" parameter in the CommandLine. level: high
Near-miss passage: Sigma rule: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the v. Logsource: windows / registry_set. Rule: title: Trust Access Disable For VBApplications id: 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf related: - id: 9b894e57-033f-46cf-b7fa-a52804181973 type: obsolete status: test description: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings. references: - https://twitter.com/inversecos/status/1494174785621819397 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) date: 2020-05-22 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Security\AccessVBOM Details: DWORD (0x00000001) condition: selection falsepositives: - Unlikely level: high