alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: telemetry for T1496.003
Matching passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Near-miss passage: T1496.001 Compute Hijacking. Tactics: impact. Description: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
Query: write Sigma for Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or othe
Matching passage: Sigma rule: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or othe. Logsource: windows / file_change. Rule: title: Unusual File Modification by dns.exe id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3 related: - id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0 type: similar status: test description: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-27 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: file_change product: windows detection: selection: Image|endswith: \dns.exe filter: TargetFilename|endswith: \dns.log condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. Logsource: windows / process_creation. Rule: title: Process Memory Dump via RdrLeakDiag.EXE id: edadb1e5-5919-4e4c-8462-a9e643b02c4b related: - id: 6355a919-2e97-4285-a673-74645566340d type: obsolete status: test description: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory references: - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/ - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/ - https://twitter.com/0gtweet/status/1299071304805560321?s=21 - https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-24 modified: 2024-08-15 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rdrleakdiag.exe - OriginalFileName: RdrLeakDiag.exe selection_cli_dump: CommandLine|contains|windash: - /memdmp - fullmemdmp selection_cli_output_process: CommandLine|contains|windash: - ' /o ' - ' /p ' condition: all of selection_* falsepositives: - Unlikely level: high
Query: alert when Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processe
Matching passage: Sigma rule: Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processe. Logsource: linux / file_event. Rule: title: Suspicious Filename with Embedded Base64 Commands id: 179b3686-6271-4d87-807d-17d843a8af73 status: experimental description: 'Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns. ' references: - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/ author: '@kostastsale' date: 2025-11-22 tags: - attack.execution - attack.stealth - attack.t1059.004 - attack.t1027 logsource: product: linux category: file_event detection: selection: TargetFilename|contains: - '{echo' - '{base64,-d}' condition: selection falsepositives: - Legitimate files with similar naming patterns (very unlikely). level: high
Near-miss passage: Sigma rule: Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microso. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Appvlp.EXE id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43 status: test description: 'Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ author: Sreeman date: 2020-03-13 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \appvlp.exe filter_main_generic: Image|endswith: - :\Windows\SysWOW64\rundll32.exe - :\Windows\System32\rundll32.exe filter_optional_office_msoasb: Image|contains: :\Program Files\Microsoft Office Image|endswith: \msoasb.exe filter_optional_office_skype: Image|contains|all: - :\Program Files\Microsoft Office - \SkypeSrv\ Image|endswith: \SKYPESERVER.EXE filter_optional_office_msouc: Image|contains: :\Program Files\Microsoft Office Image|endswith: \MSOUC.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: vulnerability: Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
Matching passage: CVE-2015-6592. CWE: CWE-254. CVSS: 6.800000190734863. Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
Near-miss passage: CVE-2015-4520. CWE: CWE-254. CVSS: 6.400000095367432. Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.
Query: alert when Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the w
Matching passage: Sigma rule: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the w. Logsource: windows / registry_set. Rule: title: Suspicious Execution Of Renamed Sysinternals Tools - Registry id: f50f3c09-557d-492d-81db-9064a8d4e211 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 8023f872-3f1d-4301-a384-801889917ab4 type: similar status: test description: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \ProcDump - \Process Explorer - \PsExec - \PsLoggedon - \PsLoglist - \PsPasswd - \PsPing - \PsService - \SDelete TargetObject|endswith: \EulaAccepted filter: Image|endswith: - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \PsLoggedon.exe - \PsLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \PsPing.exe - \PsPing64.exe - \PsPing64a.exe - \PsService.exe - \PsService64.exe - \PsService64a.exe - \sdelete.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface. Logsource: windows / process_creation. Rule: title: UAC Bypass via ICMLuaUtil id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130 status: test description: Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface references: - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html author: Florian Roth (Nextron Systems), Elastic (idea) date: 2022-09-13 modified: 2022-09-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \dllhost.exe ParentCommandLine|contains: - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} filter: - Image|endswith: \WerFault.exe - OriginalFileName: WerFault.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: alert when Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo
Matching passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: windows / process_creation. Rule: title: PUA - TruffleHog Execution id: 44030449-b0df-4c94-aae1-502359ab28ee related: - id: d7a650c4-226c-451e-948f-cc490db506aa type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \trufflehog.exe selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_trufflehog/info.yml
Near-miss passage: Sigma rule: Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and. Logsource: windows / process_creation. Rule: title: Suspicious Process Masquerading As SvcHost.EXE id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd related: - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d type: similar - id: e4a6b256-3e47-40fc-89d2-7a477edd6915 type: similar status: test description: 'Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection. ' references: - https://tria.ge/240731-jh4crsycnb/behavioral2 - https://redcanary.com/blog/threat-detection/process-masquerading/ author: Swachchhanda Shrawan Poudel date: 2024-08-07 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_img_location: Image: - C:\Windows\System32\svchost.exe - C:\Windows\SysWOW64\svchost.exe filter_main_ofn: OriginalFileName: svchost.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml
Query: detection engineering for Exploits
Matching passage: T1587.004 Exploits. Tactics: resource development. Description: Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017) As with legitimate development efforts, different skill sets may be required for developing exploits. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
Near-miss passage: T1587 Develop Capabilities. Tactics: resource development. Description: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.
Query: SOC alert related to Bidirectional Communication
Matching passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: exploit Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.
Matching passage: CVE-2015-1619. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest messages.
Near-miss passage: CVE-2015-8684. CWE: CWE-79. CVSS: 6.099999904632568. Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the elFinder functionality.
Query: describe CVE-2015-7647
Matching passage: CVE-2015-7647. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7648.
Near-miss passage: CVE-2015-4477. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.
Query: write Sigma for Detects suspicious session with two users present
Matching passage: Sigma rule: Detects suspicious session with two users present. Logsource: linux / guacamole. Rule: title: Guacamole Two Users Sharing Session Anomaly id: 1edd77db-0669-4fef-9598-165bda82826d status: test description: Detects suspicious session with two users present references: - https://research.checkpoint.com/2020/apache-guacamole-rce/ author: Florian Roth (Nextron Systems) date: 2020-07-03 modified: 2021-11-27 tags: - attack.credential-access - attack.t1212 logsource: product: linux service: guacamole detection: selection: - (2 users now present) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE id: e49b5745-1064-4ac1-9a2e-f687bc2dd37e status: test description: Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \gup.exe ImageLoaded|endswith: \libcurl.dll filter_main_notepad_plusplus: Image|endswith: \Notepad++\updater\GUP.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-3711
Matching passage: CVE-2015-3711. CWE: CWE-200. CVSS: 4.300000190734863. The NTFS implementation in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Near-miss passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.