alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
Matching passage: Sigma rule: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location. Logsource: windows / application. Rule: title: Dump Ntds.dit To Suspicious Location id: 94dc4390-6b7c-4784-8ffc-335334404650 status: test description: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location references: - https://twitter.com/mgreen27/status/1558223256704122882 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection_root: Provider_Name: ESENT EventID: 325 Data|contains: ntds.dit selection_paths: Data|contains: - :\ntds.dit - \Appdata\ - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Legitimate backup operation/creating shadow copies level: medium
Near-miss passage: Sigma rule: Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager). Logsource: windows / process_creation. Rule: title: Suspicious Key Manager Access id: a4694263-59a8-4608-a3a0-6f8d3a51664c status: test description: Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager) references: - https://twitter.com/NinjaParanoid/status/1516442028963659777 author: Florian Roth (Nextron Systems) date: 2022-04-21 modified: 2023-02-09 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - keymgr - KRShowKeyMgr condition: all of selection_* falsepositives: - Administrative activity level: high
Query: alert when Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Matching passage: Sigma rule: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of SQL Server id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 related: - id: 344482e4-a477-436c-aa70-7536d18a48c7 type: obsolete status: test description: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection. references: - Internal Research author: FPT.EagleEye Team, wagga date: 2020-12-11 modified: 2023-05-04 tags: - attack.t1505.003 - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sqlservr.exe Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \netstat.exe - \nltest.exe - \ping.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \sh.exe - \systeminfo.exe - \tasklist.exe - \wsl.exe filter_optional_datev: ParentImage|startswith: C:\Program Files\Microsoft SQL Server\ ParentImage|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe Image: C:\Windows\System32\cmd.exe CommandLine|startswith: '"C:\Windows\system32\cmd.exe" ' condition: selection and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Detects the addition of a new Federated Domain.. Logsource: m365 / exchange. Rule: title: New Federated Domain Added - Exchange id: 42127bdd-9133-474f-a6f1-97b6c08a4339 related: - id: 58f88172-a73d-442b-94c9-95eaed3cbb36 type: similar status: test description: Detects the addition of a new Federated Domain. references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ author: Splunk Threat Research Team (original rule), '@ionsor (rule)' date: 2022-02-08 tags: - attack.persistence - attack.t1136.003 logsource: service: exchange product: m365 detection: selection: eventSource: Exchange eventName: Add-FederatedDomain status: success condition: selection falsepositives: - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. level: medium
Query: Lateral movement indicators for Rename Legitimate Utilities
Matching passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Near-miss passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Query: write Sigma for Detects program executions in suspicious non-program folders related to malware or hacking activity
Matching passage: Sigma rule: Detects program executions in suspicious non-program folders related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Program Executions in Suspicious Folders id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc status: test description: Detects program executions in suspicious non-program folders related to malware or hacking activity references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-01-23 modified: 2021-11-27 tags: - attack.t1587 - attack.t1584 - attack.resource-development logsource: product: linux service: auditd detection: selection: type: SYSCALL exe|startswith: - /tmp/ - /var/www/ - /home/*/public_html/ - /usr/local/apache2/ - /usr/local/httpd/ - /var/apache/ - /srv/www/ - /home/httpd/html/ - /srv/http/ - /usr/share/nginx/html/ - /var/lib/pgsql/data/ - /usr/local/mysql/data/ - /var/lib/mysql/ - /var/vsftpd/ - /etc/bind/ - /var/named/ condition: selection falsepositives: - Admin activity (especially in /tmp folders) - Crazy web applications level: medium
Near-miss passage: Sigma rule: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190). Logsource: windows / process_creation. Rule: title: Sdiagnhost Calling Suspicious Child Process id: f3d39c45-de1a-4486-a687-ab126124f744 status: test description: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190) references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/ - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/ author: Nextron Systems, @Kostastsale date: 2022-06-01 modified: 2024-08-23 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdiagnhost.exe Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - \mshta.exe - \cscript.exe - \wscript.exe - \taskkill.exe - \regsvr32.exe - \rundll32.exe - \calc.exe filter_main_cmd_bits: Image|endswith: \cmd.exe CommandLine|contains: bits filter_main_powershell_noprofile: Image|endswith: \powershell.exe CommandLine|endswith: - -noprofile - - -noprofile condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CWE for Improper Neutralization of Input Terminators
Matching passage: CWE-147 Improper Neutralization of Input Terminators. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
Near-miss passage: CWE-230 Improper Handling of Missing Values. The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
Query: alert when Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Matching passage: Sigma rule: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash. Logsource: windows / create_stream_hash. Rule: title: Hidden Executable In NTFS Alternate Data Stream id: b69888d4-380c-45ce-9cf9-d9ce46e67821 status: test description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash references: - https://twitter.com/0xrawsec/status/1002478725605273600?s=21 author: Florian Roth (Nextron Systems), @0xrawsec date: 2018-06-03 modified: 2023-02-10 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon or equivalent configured with Imphash logging' detection: selection: Hash|contains: IMPHASH= filter_main_null: Hash|contains: IMPHASH=00000000000000000000000000000000 condition: selection and not 1 of filter_main_* falsepositives: - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar. level: medium
Near-miss passage: Sigma rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task. Logsource: windows / process_creation. Rule: title: Discovery of a System Time id: b243b280-65fe-48df-ba07-6ddea7646427 status: test description: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. references: - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-06-28 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_time: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: time selection_w32tm: Image|endswith: \w32tm.exe CommandLine|contains: tz condition: 1 of selection_* falsepositives: - Legitimate use of the system utilities to discover system time for legitimate reason level: low
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit. Logsource: windows / process_creation. Rule: title: Privilege Escalation via Named Pipe Impersonation id: 9bd04a79-dabe-4f1f-a5ff-92430265c96b related: - id: f35c5d71-b489-4e22-a115-f003df287317 type: derived status: test description: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. references: - https://www.elastic.co/guide/en/security/current/privilege-escalation-via-named-pipe-impersonation.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2022-12-30 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \cmd.exe - \powershell.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE selection_args: CommandLine|contains|all: - echo - '>' - \\\\.\\pipe\\ condition: all of selection* falsepositives: - Other programs that cause these patterns (please report) level: high
Near-miss passage: Sigma rule: Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate upda. Logsource: windows / dns_query. Rule: title: Notepad++ Updater DNS Query to Uncommon Domains id: 2074e137-1b73-4e2d-88ba-5a3407dbdce0 status: experimental description: 'Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation. ' references: - https://notepad-plus-plus.org/news/v889-released/ - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ - https://securelist.com/notepad-supply-chain-attack/118708/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-02-02 modified: 2026-03-16 tags: - attack.collection - attack.credential-access - attack.t1195.002 - attack.initial-access - attack.t1557 logsource: category: dns_query product: windows detection: selection: Image|endswith: \gup.exe filter_main_notepad_legit_domain: QueryName: notepad-plus-plus.org filter_optional_sourceforge_legit_domain: QueryName|endswith: .sourceforge.net filter_optional_github_legit_domain: - QueryName|endswith: .githubusercontent.com - QueryName: github.com filter_optional_google_storage_legit_domain: QueryName|endswith: .googleapis.com filter_optional_uncommon_domains: QueryName|endswith: - .azurewebsites.net - block.opendns.com - gateway.zscalerthree.net condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries. - Other legitimate query to official domains not listed in the filter, needing tuning. level: medium
Query: vulnerability: The relevant plugin before 1.0.8 for WordPress has XSS.
Matching passage: CVE-2015-9384. CWE: CWE-79. CVSS: 6.099999904632568. The relevant plugin before 1.0.8 for WordPress has XSS.
Near-miss passage: CVE-2015-5169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Query: explain CWE-662
Matching passage: CWE-662 Improper Synchronization. The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
Near-miss passage: CWE-437 Incomplete Model of Endpoint Features. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
Query: CVE similar to CVE-2015-5092
Matching passage: CVE-2015-5092. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5089.
Near-miss passage: CVE-2015-2877. CWE: CWE-200. CVSS: 3.299999952316284. Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities
Query: Encoded PowerShell / command-line abuse matching Dynamic Resolution
Matching passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Near-miss passage: T1568.002 Domain Generation Algorithms. Tactics: command and control. Description: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019) DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation) Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: alert when Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions. Logsource: linux / process_creation. Rule: title: ESXi Admin Permission Assigned To Account Via ESXCLI id: 9691f58d-92c1-4416-8bf3-2edd753ec9cf status: test description: Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account. references: - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-04 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1059.012 - attack.t1098 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains: system CommandLine|contains|all: - ' permission ' - ' set' - Admin condition: selection falsepositives: - Legitimate administration activities level: high
Near-miss passage: Sigma rule: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles. Logsource: windows / process_access. Rule: title: HackTool - HandleKatz Duplicating LSASS Handle id: b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5 status: test description: Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles references: - https://github.com/codewhitesec/HandleKatz author: Bhabesh Raj (rule), @thefLinkk date: 2022-06-27 modified: 2023-11-28 tags: - attack.execution - attack.t1106 - attack.t1003.001 - attack.credential-access logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess: '0x1440' CallTrace|startswith: C:\Windows\System32\ntdll.dll+ CallTrace|contains: '|UNKNOWN(' CallTrace|endswith: ) condition: selection falsepositives: - Unknown level: high