alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command lin
Matching passage: Sigma rule: Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command lin. Logsource: windows / process_creation. Rule: title: MMC20 Lateral Movement id: f1f3bf22-deb2-418d-8cce-e1a45e46a5bd status: test description: Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe references: - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view?usp=sharing author: '@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)' date: 2020-03-04 modified: 2021-11-27 tags: - attack.execution - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe Image|endswith: \mmc.exe CommandLine|contains: -Embedding condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects strings used in command execution in DNS TXT Answer. Logsource: dns. Rule: title: DNS TXT Answer with Possible Execution Strings id: 8ae51330-899c-4641-8125-e39f2e07da72 status: test description: Detects strings used in command execution in DNS TXT Answer references: - https://twitter.com/stvemillertime/status/1024707932447854592 - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1 author: Markus Neis date: 2018-08-08 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection: record_type: TXT answer|contains: - IEX - Invoke-Expression - cmd.exe condition: selection falsepositives: - Unknown level: high
Query: adversary uses Create Snapshot
Matching passage: T1578.001 Create Snapshot. Tactics: defense impairment. Description: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Query: risk of Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.
Matching passage: CVE-2015-2597. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.
Near-miss passage: CVE-2015-4887. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to ePerformance.
Query: write Sigma for Detects potential PowerShell commands or code within registry run keys
Matching passage: Sigma rule: Detects potential PowerShell commands or code within registry run keys. Logsource: windows / registry_set. Rule: title: Suspicious PowerShell In Registry Run Keys id: 8d85cf08-bf97-4260-ba49-986a2a65129c status: test description: Detects potential PowerShell commands or code within registry run keys references: - https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: frack113, Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Details|contains: - powershell - 'pwsh ' - FromBase64String - .DownloadFile( - .DownloadString( - ' -w hidden ' - ' -w 1 ' - -windowstyle hidden - -window hidden - ' -nop ' - ' -encodedcommand ' - -ExecutionPolicy Bypass - Invoke-Expression - IEX ( - Invoke-Command - ICM - - Invoke-WebRequest - 'IWR ' - Invoke-RestMethod - 'IRM ' - ' -noni ' - ' -noninteractive ' condition: selection falsepositives: - Legitimate admin or third party scripts. Baseline according to your environment level: medium
Near-miss passage: Sigma rule: Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be. Logsource: linux / auditd. Rule: title: Clipboard Collection of Image Data with Xclip Tool id: f200dc3f-b219-425d-a17e-c38467364816 status: test description: 'Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip author: Pawel Mazur date: 2021-10-01 modified: 2022-10-09 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -t a4|startswith: image/ a5: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low
Query: risk of The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive appli
Matching passage: CVE-2015-8213. CWE: CWE-200. CVSS: 5.0. The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Near-miss passage: CVE-2015-0757. CWE: CWE-200. CVSS: 5.0. The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
Query: describe CVE-2015-5560
Matching passage: CVE-2015-5560. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-8875. CWE: CWE-189. CVSS: 7.800000190734863. Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.
Query: describe CVE-2015-3458
Matching passage: CVE-2015-3458. CWE: CWE-264. CVSS: 6.5. The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Near-miss passage: CVE-2015-3847. CWE: CWE-264. CVSS: 6.400000095367432. Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.
Query: Sigma rule for Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Matching passage: Sigma rule: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\. Logsource: windows / file_event. Rule: title: Suspicious Creation with Colorcpl id: e15b518d-b4ce-4410-a9cd-501f23ce4a18 status: test description: Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\ references: - https://twitter.com/eral4m/status/1480468728324231172?s=20 author: frack113 date: 2022-01-21 modified: 2023-01-05 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: Image|endswith: \colorcpl.exe filter_ext: TargetFilename|endswith: - .icm - .gmmp - .cdmp - .camp condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious powershell command line parameters used in Empire. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell Launch Parameters id: 79f4ede3-402e-41c8-bc3e-ebbf5f162581 status: test description: Detects suspicious powershell command line parameters used in Empire references: - https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 author: Florian Roth (Nextron Systems) date: 2019-04-20 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -sta -NonI -W Hidden -Enc ' - ' -noP -sta -w 1 -enc ' - ' -NoP -NonI -W Hidden -enc ' - ' -noP -sta -w 1 -enc' - ' -enc SQB' - ' -nop -exec bypass -EncodedCommand ' condition: selection falsepositives: - Other tools that incidentally use the same command line parameters level: high
Query: write Sigma for Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro
Matching passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / ps_script. Rule: title: Root Certificate Installed - PowerShell id: 42821614-9264-4761-acfc-5772c3286f76 status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-10 modified: 2022-12-02 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains|all: - Move-Item - Cert:\LocalMachine\Root selection2: ScriptBlockText|contains|all: - Import-Certificate - Cert:\LocalMachine\Root condition: 1 of selection* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Near-miss passage: Sigma rule: Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activit. Logsource: aws / cloudtrail. Rule: title: AWS KMS Imported Key Material Usage id: 1279262f-1464-422f-ac0d-5b545320c526 status: experimental description: 'Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal. ' references: - https://www.chrisfarris.com/post/effective-aws-ransomware/ - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html author: toopricey date: 2025-10-18 tags: - attack.impact - attack.t1486 - attack.resource-development - attack.t1608.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: kms.amazonaws.com eventName: - ImportKeyMaterial - DeleteImportedKeyMaterial condition: selection falsepositives: - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements. - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise. level: high
Query: Sigma rule for Monitor and alert for changes to the device registration policy.
Matching passage: Sigma rule: Monitor and alert for changes to the device registration policy.. Logsource: azure / auditlogs. Rule: title: Changes to Device Registration Policy id: 9494bff8-959f-4440-bbce-fb87a208d517 status: test description: Monitor and alert for changes to the device registration policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484 logsource: product: azure service: auditlogs detection: selection: Category: Policy ActivityDisplayName: Set device registration policies condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects backup catalog deletions. Logsource: windows / application. Rule: title: Backup Catalog Deleted id: 9703792d-fd9a-456d-a672-ff92efe4806a status: test description: Detects backup catalog deletions references: - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) date: 2017-05-12 modified: 2022-12-25 tags: - attack.stealth - attack.t1070.004 logsource: product: windows service: application detection: selection: EventID: 524 Provider_Name: Microsoft-Windows-Backup condition: selection falsepositives: - Unknown level: medium
Query: exploit FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash
Matching passage: CVE-2015-5775. CWE: CWE-119. CVSS: 7.5. FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5756.
Near-miss passage: CVE-2015-8480. CWE: CWE-119. CVSS: 10.0. The VideoFramePool::PoolImpl::CreateFrame function in media/base/video_frame_pool.cc in Google Chrome before 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact by leveraging improper interaction with the vp3_h_loop_filter_c function in libavcodec/vp3dsp.c in FFmpeg.
Query: detect Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to in logs
Matching passage: Sigma rule: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to. Logsource: linux / process_creation. Rule: title: Curl Usage on Linux id: ea34fb97-e2c4-4afb-810f-785e4459b194 status: test description: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: linux detection: selection: Image|endswith: /curl condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: low
Near-miss passage: Sigma rule: Detects common NTLM brute force device names. Logsource: windows / ntlm. Rule: title: NTLM Brute Force id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59 status: test description: Detects common NTLM brute force device names references: - https://www.varonis.com/blog/investigate-ntlm-brute-force author: Jerry Shockley '@jsh0x' date: 2022-02-02 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8004 devicename: WorkstationName: - Rdesktop - Remmina - Freerdp - Windows7 - Windows8 - Windows2012 - Windows2016 - Windows2019 condition: selection and devicename falsepositives: - Systems with names equal to the spoofed ones used by the brute force tools level: medium
Query: alert when Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as
Matching passage: Sigma rule: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as. Logsource: windows / file_event. Rule: title: VsCode Powershell Profile Modification id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502 related: - id: b5b78988-486d-4a80-b991-930eff3ff8bf type: similar status: test description: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2023-01-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \Microsoft.VSCode_profile.ps1 condition: selection falsepositives: - Legitimate use of the profile by developers or administrators level: medium
Near-miss passage: Sigma rule: Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution. Logsource: windows / process_creation. Rule: title: PsExec Service Execution id: fdfcbd78-48f1-4a4b-90ac-d82241e368c5 related: - id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba type: obsolete status: test description: Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.youtube.com/watch?v=ro2QuZTIMBM author: Thomas Patzke, Romaissa Adjailia, Florian Roth (Nextron Systems) date: 2017-06-12 modified: 2023-02-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: - Image: C:\Windows\PSEXESVC.exe - OriginalFileName: psexesvc.exe condition: selection falsepositives: - Legitimate administrative tasks level: medium
Query: exploit SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vect
Matching passage: CVE-2015-4610. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-6028. CWE: CWE-89. CVSS: 8.800000190734863. Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.