alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a
Matching passage: Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium
Near-miss passage: Sigma rule: Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is. Logsource: windows / process_creation. Rule: title: Potentially Suspicious CMD Shell Output Redirect id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892 related: - id: aa2efee7-34dd-446e-8a37-40790a66efd7 type: derived - id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a type: similar status: test description: 'Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration. ' references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-03-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli_1: CommandLine|contains: - '>?%APPDATA%\' - '>?%TEMP%\' - '>?%TMP%\' - '>?%USERPROFILE%\' - '>?C:\ProgramData\' - '>?C:\Temp\' - '>?C:\Users\Public\' - '>?C:\Windows\Temp\' selection_cli_2: CommandLine|contains: - ' >' - '">' - '''>' CommandLine|contains|all: - C:\Users\ - \AppData\Local\ condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate admin or third party scripts used for diagnostic collection might generate some false positives level: medium
Query: common weakness: .NET Misconfiguration: Use of Impersonation
Matching passage: CWE-520 .NET Misconfiguration: Use of Impersonation. Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.
Near-miss passage: CWE-112 Missing XML Validation. The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Query: detect Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity in logs
Matching passage: Sigma rule: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. Logsource: linux / process_creation. Rule: title: Potential Perl Reverse Shell Execution id: 259df6bc-003f-4306-9f54-4ff1a08fa38e status: test description: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /perl CommandLine|contains: ' -e ' selection_content: - CommandLine|contains|all: - fdopen( - ::Socket::INET - CommandLine|contains|all: - Socket - connect - open - exec condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Identifies IPs performing DNS lookups associated with common Tor proxies.. Logsource: zeek / dns. Rule: title: DNS TOR Proxies id: a8322756-015c-42e7-afb1-436e85ed3ff5 related: - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544 type: similar - id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2 type: similar status: test description: Identifies IPs performing DNS lookups associated with common Tor proxies. references: - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml author: Saw Winn Naung , Azure-Sentinel date: 2021-08-15 modified: 2025-09-12 tags: - attack.exfiltration - attack.t1048 logsource: service: dns product: zeek detection: selection: query|endswith: - .hiddenservice.net - .onion.ca - .onion.cab - .onion.casa - .onion.city - .onion.direct - .onion.dog - .onion.glass - .onion.gq - .onion.guide - .onion.in.net - .onion.ink - .onion.it - .onion.link - .onion.lt - .onion.lu - .onion.ly - .onion.mn - .onion.network - .onion.nu - .onion.pet - .onion.plus - .onion.pt - .onion.pw - .onion.rip - .onion.sh - .onion.si - .onion.to - .onion.top - .onion.ws - .onion - .s1.tor-gateways.de - .s2.tor-gateways.de - .s3.tor-gateways.de - .s4.tor-gateways.de - .s5.tor-gateways.de - .t2w.pw - .tor2web.ae.org - .tor2web.blutmagie.de - .tor2web.com - .tor2web.fi - .tor2web.io - .tor2web.org - .tor2web.xyz - .torlink.co condition: selection falsepositives: - Unknown level: medium
Query: exploit The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to exe
Matching passage: CVE-2015-8154. CWE: CWE-264. CVSS: 8.800000190734863. The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."
Near-miss passage: CVE-2015-6980. CWE: CWE-264. CVSS: 7.800000190734863. Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to gain privileges via unspecified vectors.
Query: patch priority for CVE-2015-8148
Matching passage: CVE-2015-8148. CWE: CWE-200. CVSS: 7.5. The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.
Near-miss passage: CVE-2015-1967. CWE: CWE-200. CVSS: 4.300000190734863. MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.
Query: rule covering Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or netwo
Matching passage: Sigma rule: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or netwo. Logsource: windows / security. Rule: title: Failed Logon From Public IP id: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1 status: test description: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 author: NVISO date: 2020-05-06 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1190 - attack.t1133 logsource: product: windows service: security detection: selection: EventID: 4625 filter_main_ip_unknown: IpAddress|contains: '-' filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 condition: selection and not 1 of filter_main_* falsepositives: - Legitimate logon attempts over the internet - IPv4-to-IPv6 mapped IPs level: medium
Near-miss passage: Sigma rule: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.. Logsource: windows / process_creation. Rule: title: PUA - CleanWipe Execution id: f44800ac-38ec-471f-936e-3fa7d9c53100 status: test description: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus. references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/CleanWipe author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: Image|endswith: \SepRemovalToolNative_x64.exe selection2: Image|endswith: \CATClean.exe CommandLine|contains: --uninstall selection3: Image|endswith: \NetInstaller.exe CommandLine|contains: -r selection4: Image|endswith: \WFPUnins.exe CommandLine|contains|all: - /uninstall - /enterprise condition: 1 of selection* falsepositives: - Legitimate administrative use (Should be investigated either way) level: high
Query: mitigate Search Threat Vendor Data
Matching passage: T1681 Search Threat Vendor Data. Tactics: reconnaissance. Description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025) This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Near-miss passage: T1592.003 Firmware. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).(Citation: ArsTechnica Intel) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: CVE similar to CVE-2015-1785
Matching passage: CVE-2015-1785. CWE: CWE-434. CVSS: 6.5. In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Near-miss passage: CVE-2015-2780. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Query: indicators of Build Image on Host
Matching passage: T1612 Build Image on Host. Tactics: stealth. Description: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote <code>build</code> request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) An adversary may take advantage of that <code>build</code> API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.
Near-miss passage: T1027.015 Compression. Tactics: stealth. Description: Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., [Fileless Storage](https://attack.mitre.org/techniques/T1027/011)).(Citation: Trustwave Pillowmint June 2020) In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.(Citation: Perception Point) File archives may be sent as one [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., [Malicious File](https://attack.mitre.org/techniques/T1204/002)).(Citation: NTT Security Flagpro new December 2021) However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.(Citation: The Hacker News) [Compression](https://attack.mitre.org/techniques/T1027/015) may be used in combination with [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013) where compressed files are encrypted and password-protected.
Query: SOC alert related to GUI Input Capture
Matching passage: T1056.002 GUI Input Capture. Tactics: collection, credential access. Description: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citation: Spoofing credential dialogs) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015)(Citation: Spoofing credential dialogs) On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs) Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., [Browser Information Discovery](https://attack.mitre.org/techniques/T1217) and/or [Application Window Discovery](https://attack.mitre.org/techniques/T1010)) to spoof prompts when users are naturally accessing sensitive sites/data.
Near-miss passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Query: risk of In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer.
Matching passage: CVE-2015-9033. CWE: CWE-20. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer.
Near-miss passage: CVE-2015-1000002. CWE: CWE-20. CVSS: 8.199999809265137. Open Proxy in filedownload v1.4 wordpress plugin
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde. Logsource: windows / ps_script. Rule: title: PowerShell Deleted Mounted Share id: 66a4d409-451b-4151-94f4-a55d559c49b0 status: test description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-08 modified: 2025-10-07 tags: - attack.stealth - attack.t1070.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Remove-SmbShare - Remove-FileShare filter_main_module_load: ScriptBlockText|contains|all: - FileShare.cdxml - Microsoft.PowerShell.Core\Export-ModuleMember - ROOT/Microsoft/Windows/Storage/MSFT_FileShare - ObjectModelWrapper - Cmdletization.MethodParameter condition: selection and not 1 of filter_main_* falsepositives: - Administrators or Power users may remove their shares via cmd line level: medium
Near-miss passage: Sigma rule: Detects program executions in suspicious non-program folders related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Program Executions in Suspicious Folders id: a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc status: test description: Detects program executions in suspicious non-program folders related to malware or hacking activity references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-01-23 modified: 2021-11-27 tags: - attack.t1587 - attack.t1584 - attack.resource-development logsource: product: linux service: auditd detection: selection: type: SYSCALL exe|startswith: - /tmp/ - /var/www/ - /home/*/public_html/ - /usr/local/apache2/ - /usr/local/httpd/ - /var/apache/ - /srv/www/ - /home/httpd/html/ - /srv/http/ - /usr/share/nginx/html/ - /var/lib/pgsql/data/ - /usr/local/mysql/data/ - /var/lib/mysql/ - /var/vsftpd/ - /etc/bind/ - /var/named/ condition: selection falsepositives: - Admin activity (especially in /tmp folders) - Crazy web applications level: medium
Query: CWE for Assigning instead of Comparing
Matching passage: CWE-481 Assigning instead of Comparing. The code uses an operator for assignment when the intention was to perform a comparison.
Near-miss passage: CWE-650 Trusting HTTP Permission Methods on the Server Side. The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.