alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: ATT&CK technique for Backup Software Discovery
Matching passage: T1518.002 Backup Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of backup software or configurations that are installed on a system. Adversaries may use this information to shape follow-on behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486). Commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), `reg query` with [Reg](https://attack.mitre.org/software/S0075), `dir` with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for, such as Veeam, Acronis, Dropbox, or Paragon.(Citation: Symantec Play Ransomware 2023)
Near-miss passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Query: alert when Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Matching passage: Sigma rule: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting. Logsource: zeek / kerberos. Rule: title: Kerberos Network Traffic RC4 Ticket Encryption id: 503fe26e-b5f2-4944-a126-eab405cc06e5 status: test description: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting references: - https://adsecurity.org/?p=3458 author: sigma date: 2020-02-12 modified: 2021-11-27 tags: - attack.credential-access - attack.t1558.003 logsource: product: zeek service: kerberos detection: selection: request_type: TGS cipher: rc4-hmac computer_acct: service|startswith: $ condition: selection and not computer_acct falsepositives: - Normal enterprise SPN requests activity level: medium
Near-miss passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Query: rule covering Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool desig
Matching passage: Sigma rule: Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool desig. Logsource: windows / process_creation. Rule: title: HackTool - NetExec Execution id: 7638e5fe-600c-4289-a968-f49dd537ec7d status: experimental description: 'Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely. ' references: - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/ - https://github.com/Pennyw0rth/NetExec - https://www.netexec.wiki/ author: Chirag Damani date: 2026-03-29 tags: - attack.discovery - attack.t1018 - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection: Image|endswith: \nxc.exe CommandLine|contains: - ' ftp ' - ' ldap ' - ' mssql ' - ' nfs ' - ' rdp ' - ' smb ' - ' ssh ' - ' vnc ' - ' winrm ' - ' wmi ' condition: selection falsepositives: - Legitimate use of NetExec by security professionals or system administrators for network assessment and management. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_netexec/info.yml
Near-miss passage: Sigma rule: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing). Logsource: windows / process_creation. Rule: title: Execute Code with Pester.bat id: 59e938ff-0d6d-4dc3-b13f-36cc28734d4e status: test description: Detects code execution via Pester.bat (Pester - Powershell Modulte for testing) references: - https://twitter.com/Oddvarmoe/status/993383596244258816 - https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md author: Julia Fomina, oscd.community date: 2020-10-08 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1216 logsource: category: process_creation product: windows detection: powershell_module: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains|all: - Pester - Get-Help cmd_execution: Image|endswith: \cmd.exe CommandLine|contains|all: - pester - ; get_help: CommandLine|contains: - help - \? condition: powershell_module or (cmd_execution and get_help) falsepositives: - Legitimate use of Pester for writing tests for Powershell scripts and modules level: medium
Query: describe CVE-2015-2854
Matching passage: CVE-2015-2854. CWE: CWE-20. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element.
Near-miss passage: CVE-2015-1371. CWE: CWE-20. CVSS: 7.5. Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.
Query: exploit The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
Matching passage: CVE-2015-4719. CWE: CWE-269. CVSS: 9.800000190734863. The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
Near-miss passage: CVE-2015-2909. CWE: CWE-269. CVSS: 9.800000190734863. Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."
Query: mitigate Cloud Groups
Matching passage: T1069.003 Cloud Groups. Tactics: discovery. Description: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The <code>Get-MsolRole</code> PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command <code>az ad user get-member-groups</code> will list groups associated to a user account for Azure while the API endpoint <code>GET https://cloudidentity.googleapis.com/v1/groups</code> lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
Near-miss passage: T1069.001 Local Groups. Tactics: discovery. Description: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Query: alert when Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Matching passage: Sigma rule: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Uncommon Script Extension Execution id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee status: test description: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-06-19 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - wscript.exe - cscript.exe - Image|endswith: - \wscript.exe - \cscript.exe selection_extension: CommandLine|contains: - .csv - .dat - .doc - .gif - .jpeg - .jpg - .png - .ppt - .txt - .xls - .xml condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "mscorsvc.dll".. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of MsCorSvc.DLL id: cdb15e19-c2d0-432a-928e-e49c8c60dcf2 status: test description: Detects potential DLL sideloading of "mscorsvc.dll". references: - https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html author: Wietze Beukema date: 2024-07-11 modified: 2025-02-26 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \mscorsvc.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\Framework64\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule. level: medium
Query: write Sigma for Extract data from cab file and hide it in an alternate data stream
Matching passage: Sigma rule: Extract data from cab file and hide it in an alternate data stream. Logsource: windows / process_creation. Rule: title: Suspicious Extrac32 Alternate Data Stream Execution id: 4b13db67-0c45-40f1-aba8-66a1a7198a1e status: test description: Extract data from cab file and hide it in an alternate data stream references: - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/ author: frack113 date: 2021-11-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - extrac32.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi. Logsource: windows / registry_set. Rule: title: Enable Local Manifest Installation With Winget id: fa277e82-9b78-42dd-b05c-05555c7b6015 status: test description: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles Details: DWORD (0x00000001) condition: selection falsepositives: - Administrators or developers might enable this for testing purposes or to install custom private packages level: medium
Query: patch priority for CVE-2015-1320
Matching passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Near-miss passage: CVE-2015-2766. CWE: CWE-255. CVSS: 5.0. The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack.
Query: detection engineering for Login Hook
Matching passage: T1037.002 Login Hook. Tactics: persistence, privilege escalation. Description: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)
Near-miss passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: CVE similar to CVE-2015-0785
Matching passage: CVE-2015-0785. CWE: CWE-200. CVSS: 7.5. com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable.
Near-miss passage: CVE-2015-5909. CWE: CWE-200. CVSS: 5.0. IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery.
Query: exploit iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9378. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-1177. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
Query: CVE similar to CVE-2015-4990
Matching passage: CVE-2015-4990. CWE: CWE-200. CVSS: 4.0. The portal in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows local users to discover credentials by leveraging privileges during an unspecified connection type.
Near-miss passage: CVE-2015-0178. CWE: CWE-200. CVSS: 4.300000190734863. The Java overlay feature in IBM Bluemix Liberty before 1.13-20150209-1122 for Java does not properly support WAR applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Detects abusing Windows 10 Narrator's Feedback-Hub. Logsource: windows / registry_event. Rule: title: Narrator's Feedback-Hub Persistence id: f663a6d9-9d1b-49b8-b2b1-0637914d199a status: test description: Detects abusing Windows 10 Narrator's Feedback-Hub references: - https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html author: Dmitriy Lifanov, oscd.community date: 2019-10-25 modified: 2022-03-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_event product: windows detection: selection1: EventType: DeleteValue TargetObject|endswith: \AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\DelegateExecute selection2: TargetObject|endswith: \AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\(Default) condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a Container Registry is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Container Registry Created or Deleted id: 93e0ef48-37c8-49ed-a02c-038aab23628e status: test description: Detects when a Container Registry is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE condition: selection falsepositives: - Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: exploit Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site th
Matching passage: CVE-2015-4515. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
Near-miss passage: CVE-2015-7058. CWE: CWE-200. CVSS: 4.300000190734863. Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Query: CWE for Data Element containing Pointer Item without Proper Copy Control Element
Matching passage: CWE-1098 Data Element containing Pointer Item without Proper Copy Control Element. The code contains a data element with a pointer that does not have an associated copy or constructor method.
Near-miss passage: CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context. The product uses the singleton pattern when creating a resource within a multithreaded environment.
Query: vulnerability: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
Matching passage: CVE-2015-7275. CWE: CWE-79. CVSS: 6.099999904632568. Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
Near-miss passage: CVE-2015-2068. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.