alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects when changes are made to PIM roles
Matching passage: Sigma rule: Detects when changes are made to PIM roles. Logsource: azure / auditlogs. Rule: title: Changes To PIM Settings id: db6c06c4-bf3b-421c-aa88-15672b88c743 status: test description: Detects when changes are made to PIM roles references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.initial-access - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Update role setting in PIM condition: selection falsepositives: - Legit administrative PIM setting configuration changes level: high
Near-miss passage: Sigma rule: Detects the addition of a new network route to a route table in AWS.. Logsource: aws / cloudtrail. Rule: title: New Network Route Added id: c803b2ce-c4a2-4836-beae-b112010390b1 status: test description: 'Detects the addition of a new network route to a route table in AWS. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateRoute condition: selection falsepositives: - New VPC Creation requiring setup of a new route table - New subnets added requiring routing setup level: medium
Query: Sigma rule for Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati
Matching passage: Sigma rule: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati. Logsource: windows / file_event. Rule: title: NTDS Exfiltration Filename Patterns id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a status: test description: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration. references: - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1 - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \All.cab - .ntds.cleartext condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from t. Logsource: windows / process_creation. Rule: title: Forfiles.EXE Child Process Masquerading id: f53714ec-5077-420e-ad20-907ff9bb2958 status: test description: 'Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. ' references: - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati date: 2024-01-05 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentCommandLine|endswith: - .exe - .exe" Image|endswith: \cmd.exe CommandLine|startswith: /c echo " filter_main_parent_not_sys: ParentImage|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ ParentImage|endswith: \forfiles.exe Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ Image|endswith: \cmd.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: describe CVE-2015-1910
Matching passage: CVE-2015-1910. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1179. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.. Logsource: windows / process_creation. Rule: title: DLL Loaded via CertOC.EXE id: 242301bc-f92f-4476-8718-78004a6efd9f related: - id: 84232095-ecca-4015-b0d7-7726507ee793 type: similar status: test description: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. references: - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20 - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2 - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Austin Songer @austinsonger date: 2021-10-23 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|windash: ' -LoadDLL ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Via Stdin id: 9c14c9fa-1a63-4a64-8e57-d19280559490 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2026-03-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: (?i)(?:set).*&&\s?set.*(?:environment|invoke|\$\{?input).*&&.*" condition: selection falsepositives: - Unknown level: high
Query: detect Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co in logs
Matching passage: Sigma rule: Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with co. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure id: 70ed1d26-0050-4b38-a599-92c53d57d45a status: test description: 'Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Near-miss passage: Sigma rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p. Logsource: windows / process_creation. Rule: title: New Capture Session Launched Via DXCap.EXE id: 60f16a96-db70-42eb-8f76-16763e333590 status: test description: 'Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/ - https://twitter.com/harr0ey/status/992008180904419328 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2022-06-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \DXCap.exe - OriginalFileName: DXCap.exe selection_cli: CommandLine|contains: ' -c ' condition: all of selection* falsepositives: - Legitimate execution of dxcap.exe by legitimate user level: medium
Query: CWE for Null Byte Interaction Error (Poison Null Byte)
Matching passage: CWE-626 Null Byte Interaction Error (Poison Null Byte). The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
Near-miss passage: CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Query: describe CVE-2015-1478
Matching passage: CVE-2015-1478. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the view parameter to /classifieds.
Near-miss passage: CVE-2015-10074. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in OpenSeaMap online_chart 1.2. It has been classified as problematic. Affected is the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version staging is able to address this issue. The patch is identified as 8649157158f921590d650e2d2f4bdf0df1017e9d. It is recommended to upgrade the affected component. VDB-220218 is the identifier assigned to this vulnerability.
Query: common weakness: Improper Access Control for Register Interface
Matching passage: CWE-1262 Improper Access Control for Register Interface. The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
Near-miss passage: CWE-591 Sensitive Data Storage in Improperly Locked Memory. The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.
Query: weakness Improper Restriction of Software Interfaces to Hardware Features
Matching passage: CWE-1256 Improper Restriction of Software Interfaces to Hardware Features. The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels.
Near-miss passage: CWE-1091 Use of Object without Invoking Destructor Method. The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.
Query: CWE for Signal Handler with Functionality that is not Asynchronous-Safe
Matching passage: CWE-828 Signal Handler with Functionality that is not Asynchronous-Safe. The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.
Near-miss passage: CWE-11 ASP.NET Misconfiguration: Creating Debug Binary. Debugging messages help attackers learn about the system and plan a form of attack.
Query: alert when Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or A
Matching passage: Sigma rule: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or A. Logsource: azure / auditlogs. Rule: title: App Granted Microsoft Permissions id: c1d147ae-a951-48e5-8b41-dcd0170c7213 status: test description: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-10 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: properties.message: - Add delegated permission grant - Add app role assignment to service principal condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Near-miss passage: Sigma rule: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed AutoHotkey.EXE Execution id: 0f16d9cf-0616-45c8-8fad-becc11b5a41c status: test description: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields references: - https://www.autohotkey.com/download/ - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ author: Nasreddine Bencherchali date: 2023-02-07 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: AutoHotkey - Description|contains: AutoHotkey - OriginalFileName: - AutoHotkey.exe - AutoHotkey.rc filter: - Image|endswith: - \AutoHotkey.exe - \AutoHotkey32.exe - \AutoHotkey32_UIA.exe - \AutoHotkey64.exe - \AutoHotkey64_UIA.exe - \AutoHotkeyA32.exe - \AutoHotkeyA32_UIA.exe - \AutoHotkeyU32.exe - \AutoHotkeyU32_UIA.exe - \AutoHotkeyU64.exe - \AutoHotkeyU64_UIA.exe - Image|contains: \AutoHotkey condition: selection and not filter falsepositives: - Unknown level: medium
Query: vulnerability: Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges
Matching passage: CVE-2015-7378. CWE: CWE-276. CVSS: 7.800000190734863. Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
Near-miss passage: CVE-2015-7985. CWE: CWE-276. CVSS: 7.199999809265137. Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse steam.exe file.
Query: alert when Detects shellshock expressions in log files
Matching passage: Sigma rule: Detects shellshock expressions in log files. Logsource: linux. Rule: title: Shellshock Expression id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e status: test description: Detects shellshock expressions in log files references: - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf author: Florian Roth (Nextron Systems) date: 2017-03-14 modified: 2022-10-09 tags: - attack.persistence - attack.t1505.003 logsource: product: linux detection: keywords: - (){:;}; - () {:;}; - () { :;}; - () { :; }; condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects non-system users failing to get a handle of the SCM database.. Logsource: windows / security. Rule: title: SCM Database Handle Failure id: 13addce7-47b2-4ca0-a98f-1de964d1d669 status: test description: Detects non-system users failing to get a handle of the SCM database. references: - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-12 modified: 2022-07-11 tags: - attack.discovery - attack.t1010 logsource: product: windows service: security detection: selection: EventID: 4656 ObjectType: SC_MANAGER OBJECT ObjectName: ServicesActive AccessMask: '0xf003f' filter: SubjectLogonId: '0x3e4' condition: selection and not filter falsepositives: - Unknown level: medium
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. S. Logsource: linux / process_creation. Rule: title: ESXi VSAN Information Discovery Via ESXCLI id: d54c2f06-aca9-4e2b-81c9-5317858f4b79 status: test description: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide. references: - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: vsan selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detect use of Get-GPO to get one GPO or all the GPOs in a domain.. Logsource: windows / ps_script. Rule: title: Suspicious GPO Discovery With Get-GPO id: eb2fd349-ec67-4caa-9143-d79c7fb34441 status: test description: Detect use of Get-GPO to get one GPO or all the GPOs in a domain. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps author: frack113 date: 2022-06-04 tags: - attack.discovery - attack.t1615 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-GPO condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Query: patch priority for CVE-2015-2635
Matching passage: CVE-2015-2635. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-4893. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.
Query: rule covering Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the
Matching passage: Sigma rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the. Logsource: proxy. Rule: title: F5 BIG-IP iControl Rest API Command Execution - Proxy id: b59c98c6-95e8-4d65-93ee-f594dfb96b17 related: - id: 85254a62-22be-4239-b79c-2ec17e566c37 type: similar status: test description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP references: - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029 - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516 author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-11-08 tags: - attack.initial-access - attack.t1190 logsource: category: proxy detection: selection: cs-method: POST c-uri|endswith: /mgmt/tm/util/bash condition: selection falsepositives: - Legitimate usage of the BIG IP REST API to execute command for administration purposes level: medium
Near-miss passage: Sigma rule: Detects activity when a member is removed from a security-enabled global group. Logsource: windows / security. Rule: title: A Member Was Removed From a Security-Enabled Global Group id: 02c39d30-02b5-45d2-b435-8aebfe5a8629 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a member is removed from a security-enabled global group references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 633 - 4729 condition: selection falsepositives: - Unknown level: low
Query: exploit In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.
Matching passage: CVE-2015-9006. CWE: CWE-284. CVSS: 7.800000190734863. In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.
Near-miss passage: CVE-2015-8973. CWE: CWE-284. CVSS: 8.300000190734863. xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Query: containment actions for Persistence mechanism resembling Protocol or Service Impersonation
Matching passage: Playbook for T1001.003 Protocol or Service Impersonation. 1) Validate alert telemetry against T1001.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS en
Near-miss passage: Playbook for T1001 Data Obfuscation. Different response path focused on command and control.