alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may
Matching passage: Sigma rule: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may. Logsource: windows / ps_script. Rule: title: Service Registry Permissions Weakness Check id: 95afc12e-3cbb-40c3-9340-84a032e596a3 status: test description: 'Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4 author: frack113 date: 2021-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.011 - stp.2a logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - get-acl - REGISTRY::HKLM\SYSTEM\CurrentControlSet\Services\ condition: selection falsepositives: - Legitimate administrative script level: medium
Near-miss passage: Sigma rule: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller. Logsource: windows / process_creation. Rule: title: HackTool - SharpLdapWhoami Execution id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d status: test description: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller references: - https://github.com/bugch3ck/SharpLdapWhoami author: Florian Roth (Nextron Systems) date: 2022-08-29 modified: 2023-02-04 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection_name: Image|endswith: \SharpLdapWhoami.exe selection_pe: - OriginalFileName|contains: SharpLdapWhoami - Product: SharpLdapWhoami selection_flags1: CommandLine|endswith: - ' /method:ntlm' - ' /method:kerb' - ' /method:nego' - ' /m:nego' - ' /m:ntlm' - ' /m:kerb' condition: 1 of selection* falsepositives: - Programs that use the same command line flags level: high
Query: CVE similar to CVE-2015-5901
Matching passage: CVE-2015-5901. CWE: CWE-200. CVSS: 2.0999999046325684. The Secure Empty Trash feature in Finder in Apple OS X before 10.11 improperly deletes Trash files, which might allow local users to obtain sensitive information by reading storage media, as demonstrated by reading a flash drive.
Near-miss passage: CVE-2015-0174. CWE: CWE-200. CVSS: 4.0. The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: rule covering Detects read access to a domain user from a non-machine account
Matching passage: Sigma rule: Detects read access to a domain user from a non-machine account. Logsource: windows / security. Rule: title: Potential AD User Enumeration From Non-Machine Account id: ab6bffca-beff-4baa-af11-6733f296d57a status: test description: Detects read access to a domain user from a non-machine account references: - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662 author: Maxime Thiebaut (@0xThiebaut) date: 2020-03-30 modified: 2022-11-08 tags: - attack.discovery - attack.t1087.002 logsource: product: windows service: security definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal' detection: selection: EventID: 4662 ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2 AccessMask|endswith: - 1? - 3? - 4? - 7? - 9? - B? - D? - F? filter_main_machine_accounts: SubjectUserName|endswith: $ filter_main_msql: SubjectUserName|startswith: MSOL_ condition: selection and not 1 of filter_main_* falsepositives: - Administrators configuring new users. level: medium
Near-miss passage: Sigma rule: Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecur. Logsource: windows / registry_set. Rule: title: UAC Secure Desktop Prompt Disabled id: 0d7ceeef-3539-4392-8953-3dc664912714 related: - id: c5f6a85d-b647-40f7-bbad-c10b66bab038 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that''s isolated from other processes running on the system. It''s designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user''s current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md author: frack113 date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-1815
Matching passage: CVE-2015-1815. CWE: CWE-77. CVSS: 10.0. The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Near-miss passage: CVE-2015-9059. CWE: CWE-77. CVSS: 9.800000190734863. picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.
Query: vulnerability: ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the tem
Matching passage: CVE-2015-3405. CWE: CWE-331. CVSS: 7.5. ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Near-miss passage: CVE-2015-3006. CWE: CWE-331. CVSS: 6.5. On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability.
Query: SIEM correlation: stealth activity consistent with System Firmware
Matching passage: T1542.001 System Firmware. Tactics: stealth, persistence. Description: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI) System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.
Near-miss passage: T1542 Pre-OS Boot. Tactics: stealth, persistence. Description: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Query: rule covering Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al
Matching passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setuid Capability Set on a Binary via Setcap Utility id: ed447910-bc30-4575-a598-3a2e49516a7a status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setuid'' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setuid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setuid condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Indicates sign-in from a malicious IP address based on high failure rates.. Logsource: azure / riskdetection. Rule: title: Malicious IP Address Sign-In Failure Rate id: a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd status: test description: Indicates sign-in from a malicious IP address based on high failure rates. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: maliciousIPAddress condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: vulnerability: ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query fol
Matching passage: CVE-2015-7387. CWE: CWE-89. CVSS: 7.5. ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Near-miss passage: CVE-2015-7390. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers. Logsource: windows / security. Rule: title: DPAPI Domain Backup Key Extraction id: 4ac1f50b-3bd0-4968-902d-868b4647937e status: test description: Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers references: - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-06-20 modified: 2022-02-24 tags: - attack.credential-access - attack.t1003.004 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectType: SecretObject AccessMask: '0x2' ObjectName|contains: BCKUPKEY condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitim. Logsource: windows / process_creation. Rule: title: Windows Defender Disabled Via SystemSettingsAdminFlows.EXE id: da92713f-ca2d-4fab-8320-098013d3f43a status: experimental description: 'Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks. However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns. ' references: - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ - https://www.huntress.com/blog/lolbin-to-inc-ransomware tags: - attack.defense-impairment - attack.t1685 author: Chirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 logsource: category: process_creation product: windows detection: selection_ssaf_img: - Image|endswith: \SystemSettingsAdminFlows.exe - OriginalFileName: SystemSettingsAdminFlows.EXE selection_ssaf_cli: CommandLine|contains: defender selection_cli_enable_opt: CommandLine|contains: - 'RTP ' - 'RealTimeProtection ' - 'DisableEnhancedNotifications ' selection_cli_enable_value: CommandLine|contains: '1' selection_cli_disable_opt: CommandLine|contains: - 'SubmitSamplesConsent ' - 'SpyNetReporting ' - 'DisableCDPUserAuthPolicy ' selection_cli_disable_value: CommandLine|contains: '0' condition: all of selection_ssaf_* and (all of selection_cli_enable_* or all of selection_cli_disable_*) falsepositives: - Legitimate turn off of Windows Defender by the technical users or administrators for troubleshooting or other purposes. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_systemsettingsadminflows_defender_disable/info.yml
Query: resource development using Exploits
Matching passage: T1587.004 Exploits. Tactics: resource development. Description: Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017) As with legitimate development efforts, different skill sets may be required for developing exploits. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
Near-miss passage: T1587.002 Code Signing Certificates. Tactics: resource development. Description: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
Query: weakness Use of Weak Hash
Matching passage: CWE-328 Use of Weak Hash. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
Near-miss passage: CWE-453 Insecure Default Variable Initialization. The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
Query: alert when Detects the execution of "logman" utility in order to disable or delete Windows trace sessions
Matching passage: Sigma rule: Detects the execution of "logman" utility in order to disable or delete Windows trace sessions. Logsource: windows / process_creation. Rule: title: Suspicious Windows Trace ETW Session Tamper Via Logman.EXE id: cd1f961e-0b96-436b-b7c6-38da4583ec00 status: test description: Detects the execution of "logman" utility in order to disable or delete Windows trace sessions references: - https://twitter.com/0gtweet/status/1359039665232306183?s=21 - https://ss64.com/nt/logman.html author: Florian Roth (Nextron Systems) date: 2021-02-11 modified: 2023-02-21 tags: - attack.defense-impairment - attack.t1685 - attack.t1685.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \logman.exe - OriginalFileName: Logman.exe selection_action: CommandLine|contains: - 'stop ' - 'delete ' selection_service: CommandLine|contains: - Circular Kernel Context Logger - EventLog- - SYSMON TRACE - SysmonDnsEtwSession condition: all of selection* falsepositives: - Legitimate deactivation by administrative staff - Installer tools that disable services, e.g. before log collection agent installation level: high
Near-miss passage: Sigma rule: Use of reg to get MachineGuid information. Logsource: windows / process_creation. Rule: title: Suspicious Query of MachineGUID id: f5240972-3938-4e56-8e4b-e33893176c1f status: test description: Use of reg to get MachineGuid information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-8---windows-machineguid-discovery author: frack113 date: 2022-01-01 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - SOFTWARE\Microsoft\Cryptography - '/v ' - MachineGuid condition: selection falsepositives: - Unknown level: low
Query: Sigma rule for An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - NetSupport Execution id: 758ff488-18d5-4cbe-8ec4-02b6285a434f status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md author: frack113 date: 2022-09-25 modified: 2023-03-06 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: NetSupport Client Configurator - Product: NetSupport Remote Control - Company: NetSupport Ltd - OriginalFileName: PCICFGUI.EXE condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to ga. Logsource: windows / process_creation. Rule: title: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS id: 575dce0c-8139-4e30-9295-1ee75969f7fe related: - id: f92a6f1e-a512-4a15-9735-da09e78d7273 type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: blueteamer8699 date: 2022-01-03 modified: 2023-02-08 tags: - attack.discovery - attack.execution - attack.t1615 - attack.t1059.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: gatherNetworkInfo.vbs condition: all of selection_* falsepositives: - Administrative activity level: medium