alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects usage of attrib.exe to hide files from users.
Matching passage: Sigma rule: Detects usage of attrib.exe to hide files from users.. Logsource: windows / process_creation. Rule: title: Hiding Files with Attrib.exe id: 4281cb20-2994-4580-aa63-c8b86d019934 status: test description: Detects usage of attrib.exe to hide files from users. references: - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ - https://www.uptycs.com/blog/lolbins-are-no-laughing-matter author: Sami Ruohonen date: 2019-01-16 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +h ' filter_main_msiexec: CommandLine|contains: '\desktop.ini ' filter_optional_intel: ParentImage|endswith: \cmd.exe CommandLine: +R +H +S +A \\\*.cui ParentCommandLine: C:\\WINDOWS\\system32\\\*.bat condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - IgfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe) - Msiexec.exe hiding desktop.ini level: medium
Near-miss passage: Sigma rule: Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet. Logsource: windows / process_creation. Rule: title: Suspicious Desktopimgdownldr Command id: bb58aa4a-b80b-415a-a2c0-2f65a4c81009 status: test description: Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet references: - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/ - https://twitter.com/SBousseaden/status/1278977301745741825 author: Florian Roth (Nextron Systems) date: 2020-07-03 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: ' /lockscreenurl:' selection1_filter: CommandLine|contains: - .jpg - .jpeg - .png selection_reg: CommandLine|contains|all: - reg delete - \PersonalizationCSP condition: ( selection1 and not selection1_filter ) or selection_reg falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Query: SOC alert related to Invalid Code Signature
Matching passage: T1036.001 Invalid Code Signature. Tactics: stealth. Description: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.
Near-miss passage: T1036.009 Break Process Trees. Tactics: stealth. Description: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) On Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree. Another example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022)
Query: rule covering Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too
Matching passage: Sigma rule: Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too. Logsource: windows / registry_set. Rule: title: Hide Schedule Task Via Index Value Tamper id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: 'Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique) ' references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Logsource: linux / process_creation. Rule: title: Mask System Power Settings Via Systemctl id: c172b7b5-f3a1-4af2-90b7-822c63df86cb status: experimental description: 'Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity. ' author: Milad Cheraghi, Nasreddine Bencherchali date: 2025-10-17 references: - https://www.man7.org/linux/man-pages/man1/systemctl.1.html - https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/ tags: - attack.persistence - attack.impact - attack.t1653 logsource: category: process_creation product: linux detection: selection_systemctl: Image|endswith: /systemctl CommandLine|contains: ' mask' selection_power_options: CommandLine|contains: - suspend.target - hibernate.target - hybrid-sleep.target condition: all of selection_* falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-7464
Matching passage: CVE-2015-7464. CWE: UNKNOWN. CVSS: 7.5. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to cause a denial of service (Report Builder server outage) via a crafted request to a Report Builder instance URL.
Near-miss passage: CVE-2015-2342. CWE: UNKNOWN. CVSS: 10.0. The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
Query: detect Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory in logs
Matching passage: Sigma rule: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: Renamed CreateDump Utility Execution id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e related: - id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 type: similar status: test description: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems) date: 2022-09-20 modified: 2023-02-14 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_pe: OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: - CommandLine|contains|all: - ' -u ' - ' -f ' - .dmp - CommandLine|contains|all: - ' --full ' - ' --name ' - .dmp filter: Image|endswith: \createdump.exe condition: 1 of selection_* and not filter falsepositives: - Command lines that use the same flags level: high
Near-miss passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / file_event. Rule: title: Wmiprvse Wbemcomn DLL Hijack - File id: 614a7e17-5643-4d89-b6fe-f9df1a79641c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-12-02 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: critical
Query: Persistence mechanism resembling Steganography
Matching passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Near-miss passage: T1027 Obfuscated Files or Information. Tactics: stealth. Description: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)
Query: vulnerability: Qolsys IQ Panel (aka QOL) before 1.5.1 has hardcoded cryptographic keys, which allows remote attackers to create digital signatures for code by leveraging knowledge of a key from a
Matching passage: CVE-2015-6032. CWE: CWE-255. CVSS: 9.300000190734863. Qolsys IQ Panel (aka QOL) before 1.5.1 has hardcoded cryptographic keys, which allows remote attackers to create digital signatures for code by leveraging knowledge of a key from a different installation.
Near-miss passage: CVE-2015-6472. CWE: CWE-255. CVSS: 9.800000190734863. WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management.
Query: rule covering Detects possible suspicious glue development endpoint activity.
Matching passage: Sigma rule: Detects possible suspicious glue development endpoint activity.. Logsource: aws / cloudtrail. Rule: title: AWS Glue Development Endpoint Activity id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26 status: test description: Detects possible suspicious glue development endpoint activity. references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html author: Austin Songer @austinsonger date: 2021-10-03 modified: 2022-12-18 tags: - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: glue.amazonaws.com eventName: - CreateDevEndpoint - DeleteDevEndpoint - UpdateDevEndpoint condition: selection falsepositives: - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the us. Logsource: windows / process_creation. Rule: title: Powershell Executed From Headless ConHost Process id: 056c7317-9a09-4bd4-9067-d051312752ea related: - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc type: derived status: test description: 'Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution. ' references: - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software author: Matt Anderson (Huntress) date: 2024-07-23 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1059.003 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \conhost.exe - OriginalFileName: CONHOST.EXE selection_cli: CommandLine|contains|all: - --headless - powershell condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
Query: exploit The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry 
Matching passage: CVE-2015-3193. CWE: CWE-200. CVSS: 7.5. The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
Near-miss passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Query: CVE similar to CVE-2015-8222
Matching passage: CVE-2015-8222. CWE: CWE-264. CVSS: 4.599999904632568. The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix.socket, which allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-2525. CWE: CWE-264. CVSS: 7.199999809265137. Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass intended filesystem restrictions and delete arbitrary files via unspecified vectors, aka "Windows Task File Deletion Elevation of Privilege Vulnerability."
Query: alert when Detects suspicious Spring framework exceptions that could indicate exploitation attempts
Matching passage: Sigma rule: Detects suspicious Spring framework exceptions that could indicate exploitation attempts. Logsource: spring / application. Rule: title: Spring Framework Exceptions id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33 status: stable description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts references: - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html author: Thomas Patzke date: 2017-08-06 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: spring detection: keywords: - AccessDeniedException - CsrfException - InvalidCsrfTokenException - MissingCsrfTokenException - CookieTheftException - InvalidCookieException - RequestRejectedException condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because. Logsource: antivirus. Rule: title: Antivirus - Remote Access Tools Signature id: 97233998-3838-4581-88c6-f1d19d3993fb status: experimental description: 'Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466 author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: Signature|contains: - AgentB - AgentTesla - AMRat - Ammyy - AsyncRAT - Bandook - Bitrat - Bladabindi - Connectwise - CyberGate - DarkComet - DCrat - Delf - DokStorm - Egairtigado - Gh0st - Gorat - GodRat - Jalapeno - LummaC2 - Minirat - Netwire - NanoCore - NJRat - Paralax - PlugX - Pulsar - Quasar - Remcos - Ravartar - RemoteAdmin - RemoteTool - revengeRAT - rokRAT - salatstealer - Salgorea - SmokedHam - TigerRat - Tzeebot - WarZone - VenomRAT - Vidar - Wirenet - XWorm - Zapchast - Zegost condition: selection falsepositives: - Unlikely level: critical
Query: CVE similar to CVE-2015-5853
Matching passage: CVE-2015-5853. CWE: CWE-200. CVSS: 3.299999952316284. AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors.
Near-miss passage: CVE-2015-8544. CWE: CWE-200. CVSS: 7.5. NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors.
Query: common weakness: Exposure of Sensitive Information during Transient Execution
Matching passage: CWE-1420 Exposure of Sensitive Information during Transient Execution. A processor event or prediction may allow incorrect operations (or correct operations with incorrect data) to execute transiently, potentially exposing data over a covert channel.
Near-miss passage: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'). The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Query: describe CVE-2015-6846
Matching passage: CVE-2015-6846. CWE: CWE-255. CVSS: 6.800000190734863. EMC SourceOne Email Supervisor before 7.2 uses hardcoded encryption keys, which makes it easier for attackers to obtain access by examining how a program's code conducts cryptographic operations.
Near-miss passage: CVE-2015-4400. CWE: CWE-255. CVSS: 4.599999904632568. Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up button and leveraging an API in the GainSpan Wi-Fi module.
Query: patch priority for CVE-2015-0119
Matching passage: CVE-2015-0119. CWE: CWE-284. CVSS: 7.5. FastBack Mount in IBM Tivoli Storage Manager FastBack 6.1.x before 6.1.11.1 allows remote attackers to execute arbitrary code by connecting to the Mount port.
Near-miss passage: CVE-2015-9021. CWE: CWE-284. CVSS: 5.5. In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled.
Query: Encoded PowerShell / command-line abuse matching Office Application Startup
Matching passage: T1137 Office Application Startup. Tactics: persistence. Description: Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: SensePost Ruler GitHub) These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: TechNet O365 Outlook Rules)
Near-miss passage: T1137.003 Outlook Forms. Tactics: persistence. Description: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms) Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)