alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection engineering for Vulnerabilities
Matching passage: T1588.006 Vulnerabilities. Tactics: resource development. Description: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).
Near-miss passage: T1588.003 Code Signing Certificates. Tactics: resource development. Description: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.
Query: write Sigma for Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files
Matching passage: Sigma rule: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSPUB.EXE id: 3b3c7f55-f771-4dd6-8a6e-08d057a17caf status: test description: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-02-08 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSPUB.exe - OriginalFileName: MSPUB.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe. Logsource: windows / ps_module. Rule: title: Suspicious Get Local Groups Information id: cef24b90-dddc-4ae1-a09a-8764872f69fc related: - id: fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb type: similar status: test description: 'Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2025-08-22 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_localgroup: - Payload|contains: - 'get-localgroup ' - 'get-localgroupmember ' - ContextInfo|contains: - 'get-localgroup ' - 'get-localgroupmember ' selection_wmi_module: - Payload|contains: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' - ContextInfo|contains|all: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' selection_wmi_class: - Payload|contains: win32_group - ContextInfo|contains: win32_group condition: selection_localgroup or all of selection_wmi_* falsepositives: - Administrator script level: low
Query: common weakness: Missing Source Correlation of Multiple Independent Data
Matching passage: CWE-1293 Missing Source Correlation of Multiple Independent Data. The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
Near-miss passage: CWE-797 Only Filtering Special Elements at an Absolute Position. The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. byte number 10), thereby missing remaining special elements that may exist before sending it to a downstream component.
Query: rule covering Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
Matching passage: Sigma rule: Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns-client. Rule: title: DNS Query for Anonfiles.com Domain - DNS Client id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 related: - id: 065cceea-77ec-4030-9052-fc0affea7110 type: similar status: test description: Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Near-miss passage: Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: macos / process_creation. Rule: title: System Shutdown/Reboot - MacOs id: 40b1fbe2-18ea-4ee7-be47-0294285811de status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: macos category: process_creation detection: selection: Image|endswith: - /shutdown - /reboot - /halt condition: selection falsepositives: - Legitimate administrative activity level: informational
Query: describe CVE-2015-10110
Matching passage: CVE-2015-10110. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
Near-miss passage: CVE-2015-0216. CWE: CWE-79. CVSS: 3.5. access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.
Query: Sigma YAML for azure / auditlogs
Matching passage: Sigma rule: Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions. Logsource: azure / auditlogs. Rule: title: App Granted Privileged Delegated Or App Permissions id: 5aecf3d5-f8a0-48e7-99be-3a759df7358f related: - id: ba2a7c80-027b-460f-92e2-57d113897dbc type: obsolete status: test description: Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 modified: 2023-03-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1098.003 logsource: product: azure service: auditlogs detection: selection: properties.message: Add app role assignment to service principal condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Near-miss passage: Sigma rule: Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information dis. Logsource: macos / process_creation. Rule: title: System Information Discovery Using Ioreg id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0 status: test description: 'Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings. ' references: - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 modified: 2024-01-02 tags: - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /ioreg - CommandLine|contains: ioreg selection_cmd1: CommandLine|contains: - -l - -c selection_cmd2: CommandLine|contains: - AppleAHCIDiskDriver - IOPlatformExpertDevice - Oracle - Parallels - USB Vendor Name - VirtualBox - VMware condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Query: CVE similar to CVE-2015-4670
Matching passage: CVE-2015-4670. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
Near-miss passage: CVE-2015-9266. CWE: CWE-22. CVSS: 9.800000190734863. The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
Query: describe CVE-2015-2122
Matching passage: CVE-2015-2122. CWE: CWE-399. CVSS: 7.800000190734863. The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port.
Near-miss passage: CVE-2015-0042. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0046.
Query: Sigma rule for Detects the execution of whoami that has been renamed to a different name to avoid detection
Matching passage: Sigma rule: Detects the execution of whoami that has been renamed to a different name to avoid detection. Logsource: windows / process_creation. Rule: title: Renamed Whoami Execution id: f1086bf7-a0c4-4a37-9102-01e573caf4a0 status: test description: Detects the execution of whoami that has been renamed to a different name to avoid detection references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ author: Florian Roth (Nextron Systems) date: 2021-08-12 modified: 2022-10-09 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: OriginalFileName: whoami.exe filter: Image|endswith: \whoami.exe condition: selection and not filter falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects files dropped by Winnti as described in RedMimicry Winnti playbook. Logsource: windows / file_event. Rule: title: Potential Winnti Dropper Activity id: 130c9e58-28ac-4f83-8574-0a4cc913b97e status: test description: Detects files dropped by Winnti as described in RedMimicry Winnti playbook references: - https://redmimicry.com/posts/redmimicry-winnti/#dropper author: Alexander Rausch date: 2020-06-24 modified: 2023-01-05 tags: - attack.stealth - attack.t1027 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \gthread-3.6.dll - \sigcmm-2.4.dll - \Windows\Temp\tmp.bat condition: selection falsepositives: - Unknown level: high
Query: detect Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate in logs
Matching passage: Sigma rule: Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate. Logsource: windows / file_event. Rule: title: EVTX Created In Uncommon Location id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb status: test description: 'Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting. ' references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2024-03-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: file_event product: windows definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>' detection: selection: TargetFilename|endswith: .evtx filter_main_path: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ filter_main_baseimage: TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\ TargetFilename|endswith: \Windows\System32\winevt\Logs\ condition: selection and not 1 of filter_main_* falsepositives: - Administrator or backup activity - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml
Near-miss passage: Sigma rule: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machi. Logsource: windows / security. Rule: title: DCERPC SMB Spoolss Named Pipe id: 214e8f95-100a-4e04-bb31-ef6cba8ce07e status: test description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 - https://dirkjanm.io/a-different-way-of-abusing-zerologon/ - https://twitter.com/_dirkjan/status/1309214379003588608 author: OTR (Open Threat Research) date: 2018-11-28 modified: 2022-08-11 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName: spoolss condition: selection falsepositives: - Domain Controllers acting as printer servers too? :) level: medium
Query: CVE similar to CVE-2015-1417
Matching passage: CVE-2015-1417. CWE: CWE-400. CVSS: 7.5. The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.
Near-miss passage: CVE-2015-9241. CWE: CWE-400. CVSS: 7.5. Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
Query: Encoded PowerShell / command-line abuse matching Gather Victim Org Information
Matching passage: T1591 Gather Victim Org Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1591.004 Identify Roles. Tactics: reconnaissance. Description: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Query: Suspicious Exfiltration to Code Repository execution detected on endpoint
Matching passage: T1567.001 Exfiltration to Code Repository. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Near-miss passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.