alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SOC runbook when seeing Multiple failed authentications followed by Image File Execution Options Injection
Matching passage: Playbook for T1546.012 Image File Execution Options Injection. 1) Validate alert telemetry against T1546.012. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: privilege escalation, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g.,
Near-miss passage: Playbook for T1546.014 Emond. Different response path focused on privilege escalation, persistence.
Query: exploit The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause 
Matching passage: CVE-2015-0288. CWE: UNKNOWN. CVSS: 5.0. The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Near-miss passage: CVE-2015-0358. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0351, and CVE-2015-3039.
Query: alert when Identifies user login with multifactor authentication failures, which might be an indication an attacker has the passwor
Matching passage: Sigma rule: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the passwor. Logsource: azure / signinlogs. Rule: title: Multifactor Authentication Interrupted id: 5496ff55-42ec-4369-81cb-00f417029e25 status: test description: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 - attack.t1621 logsource: product: azure service: signinlogs detection: selection_50074: ResultType: 50074 ResultDescription|contains: Strong Auth required selection_500121: ResultType: 500121 ResultDescription|contains: Authentication failed during strong authentication request condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Query: Sigma rule for Identifies when a service account is disabled or deleted in Google Cloud.
Matching passage: Sigma rule: Identifies when a service account is disabled or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Disabled or Deleted id: 13f81a90-a69c-4fab-8f07-b5bb55416a9f status: test description: Identifies when a service account is disabled or deleted in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact - attack.t1531 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.disable - .serviceAccounts.delete condition: selection falsepositives: - Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.. Logsource: juniper / bgp. Rule: title: Juniper BGP Missing MD5 id: a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 status: test description: Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing. references: - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf author: Tim Brown date: 2023-01-09 modified: 2023-01-23 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.collection - attack.stealth - attack.t1078 - attack.t1110 - attack.t1557 logsource: product: juniper service: bgp definition: 'Requirements: juniper bgp logs need to be enabled and ingested' detection: keywords_bgp_juniper: '|all': - :179 - missing MD5 digest condition: keywords_bgp_juniper falsepositives: - Unlikely. Except due to misconfigurations level: low
Query: common weakness: Class Instance Self Destruction Control Element
Matching passage: CWE-1082 Class Instance Self Destruction Control Element. The code contains a class instance that calls the method or function to delete or destroy itself.
Near-miss passage: CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection). The product does not adequately filter user-controlled input for special elements with control implications.
Query: CVE similar to CVE-2015-0639
Matching passage: CVE-2015-0639. CWE: CWE-20. CVSS: 7.800000190734863. The Common Flow Table (CFT) feature in Cisco IOS XE 3.6 and 3.7 before 3.7.1S, 3.8 before 3.8.0S, 3.9 before 3.9.0S, 3.10 before 3.10.0S, 3.11 before 3.11.0S, 3.12 before 3.12.0S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S, when MMON or NBAR is enabled, allows remote attackers to cause a denial of service (device reload) via malformed IPv6 packets with IPv4 UDP encapsulation, aka Bug ID CSCua79665.
Near-miss passage: CVE-2015-2412. CWE: CWE-20. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to read arbitrary local files via a crafted pathname, aka "Internet Explorer Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-6658
Matching passage: CVE-2015-6658. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
Near-miss passage: CVE-2015-5481. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Query: what is T1057
Matching passage: T1057 Process Discovery. Tactics: discovery. Description: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)
Near-miss passage: T1087 Account Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
Query: Sigma YAML for windows / appmodel-runtime
Matching passage: Sigma rule: Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get acces. Logsource: windows / appmodel-runtime. Rule: title: Sysinternals Tools AppX Versions Execution id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc status: test description: 'Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 modified: 2023-09-12 tags: - attack.execution - attack.stealth logsource: product: windows service: appmodel-runtime detection: selection: EventID: 201 ImageName: - procdump.exe - psloglist.exe - psexec.exe - livekd.exe - ADExplorer.exe condition: selection falsepositives: - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed. level: low
Near-miss passage: Sigma rule: Detects command line parameters used by Hydra password guessing hack tool. Logsource: windows / process_creation. Rule: title: HackTool - Hydra Password Bruteforce Execution id: aaafa146-074c-11eb-adc1-0242ac120002 status: test description: Detects command line parameters used by Hydra password guessing hack tool references: - https://github.com/vanhauser-thc/thc-hydra author: Vasiliy Burov date: 2020-10-05 modified: 2023-02-04 tags: - attack.credential-access - attack.t1110 - attack.t1110.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '-u ' - '-p ' CommandLine|contains: - ^USER^ - ^PASS^ condition: selection falsepositives: - Software that uses the caret encased keywords PASS and USER in its command line level: high
Query: SOC runbook when seeing Suspicious Launchd execution detected on endpoint
Matching passage: Playbook for T1053.004 Launchd. 1) Validate alert telemetry against T1053.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution, persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or r
Near-miss passage: Playbook for T1053.007 Container Orchestration Job. Different response path focused on execution, persistence, privilege escalation.
Query: Outbound C2 pattern associated with Component Object Model Hijacking
Matching passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Near-miss passage: T1546.006 LC_LOAD_DYLIB Addition. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes. Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X)
Query: vulnerability: GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a differen
Matching passage: CVE-2015-0272. CWE: UNKNOWN. CVSS: 5.0. GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Near-miss passage: CVE-2015-8580. CWE: UNKNOWN. CVSS: 6.800000190734863. Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPDF before 7.2.2 allow remote attackers to execute arbitrary code via a crafted PDF document.
Query: write Sigma for Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroo
Matching passage: Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroo. Logsource: windows / process_creation. Rule: title: Uncommon AddinUtil.EXE CommandLine Execution id: 4f2cd9b6-4a17-440f-bb2a-687abb65993a status: test description: 'Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe selection_cli: CommandLine|contains: - '-AddInRoot:' - '-PipelineRoot:' filter_main_addinroot: CommandLine|contains: - -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA - -AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA - -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA - -PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created a. Logsource: m365 / threat_management. Rule: title: Suspicious Inbox Forwarding id: 6c220477-0b5b-4b25-bb90-66183b4089e8 status: test description: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-22 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1020 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious inbox forwarding status: success condition: selection falsepositives: - Unknown level: low
Query: CVE similar to CVE-2015-2905
Matching passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Near-miss passage: CVE-2015-6973. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp.
Query: patch priority for CVE-2015-4541
Matching passage: CVE-2015-4541. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6506. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.
Query: write Sigma for Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP OS Scan id: e8a677fd-248c-4eab-94df-de2f6f645884 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5002 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious Plink tunnel port forwarding to a local port. Logsource: windows / process_creation. Rule: title: Suspicious Plink Port Forwarding id: 48a61b29-389f-4032-b317-b30de6b95314 status: test description: Detects suspicious Plink tunnel port forwarding to a local port references: - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/ - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d author: Florian Roth (Nextron Systems) date: 2021-01-19 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection: Description: Command-line SSH, Telnet, and Rlogin client CommandLine|contains: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: high