alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: SIEM correlation: impact activity consistent with Financial Theft
Matching passage: T1657 Financial Theft. Tactics: impact. Description: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin) Adversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1684/001) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC) Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary.(Citation: Mandiant-leaks) Adversaries may use dedicated leak sites to distribute victim data.(Citation: Crowdstrike-leaks) Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business
Near-miss passage: T1499.003 Application Exhaustion Flood. Tactics: impact. Description: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
Query: rule covering Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet
Matching passage: Sigma rule: Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_event. Rule: title: Wdigest CredGuard Registry Modification id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd status: test description: 'Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials. ' references: - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-08-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \IsCredGuardEnabled condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remo. Logsource: windows / system. Rule: title: New PDQDeploy Service - Client Side id: b98a10af-1e1e-44a7-bab2-4cc026917648 status: test description: 'Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1 ' references: - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: PDQDeployRunner- - ServiceName|startswith: PDQDeployRunner- condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Query: alert when This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t
Matching passage: Sigma rule: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t. Logsource: windows / registry_set. Rule: title: Execution DLL of Choice Using WAB.EXE id: fc014922-5def-4da9-a0fc-28c973f41bfb status: test description: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry. references: - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml - https://twitter.com/Hexacorn/status/991447379864932352 - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ author: oscd.community, Natalia Shornikova date: 2020-10-13 modified: 2023-08-17 tags: - attack.stealth - attack.t1218 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\WAB\DLLPath filter: Details: '%CommonProgramFiles%\System\wab32.dll' condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an the Administrator role is assigned to an user or group.. Logsource: okta / okta. Rule: title: Okta Admin Role Assigned to an User or Group id: 413d4a81-6c98-4479-9863-014785fd579c status: test description: Detects when an the Administrator role is assigned to an user or group. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.003 logsource: product: okta service: okta detection: selection: eventType: - group.privilege.grant - user.account.privilege.grant condition: selection falsepositives: - Administrator roles could be assigned to users or group by other admin users. level: medium
Query: exploit The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
Matching passage: CVE-2015-0844. CWE: CWE-200. CVSS: 5.0. The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
Near-miss passage: CVE-2015-3690. CWE: CWE-200. CVSS: 4.300000190734863. The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: CVE similar to CVE-2015-0327
Matching passage: CVE-2015-0327. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0323.
Near-miss passage: CVE-2015-5890. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5872, and CVE-2015-5873.
Query: detect Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an at in logs
Matching passage: Sigma rule: Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an at. Logsource: windows / process_creation. Rule: title: Remotely Hosted HTA File Executed Via Mshta.EXE id: b98d0db6-511d-45de-ad02-e82a98729620 status: test description: Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file references: - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-08 modified: 2023-02-06 tags: - attack.execution - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_cli: CommandLine|contains: - http:// - https:// - ftp:// condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect adversaries enumerate sensitive files. Logsource: windows / ps_script. Rule: title: Powershell Sensitive File Discovery id: 7d416556-6502-45b2-9bad-9d2f05f38997 related: - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9 type: derived status: test description: Detect adversaries enumerate sensitive files references: - https://twitter.com/malmoeb/status/1570814999370801158 author: frack113 date: 2022-09-16 tags: - attack.discovery - attack.t1083 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_action: ScriptBlockText|contains: - ls - get-childitem - gci selection_recurse: ScriptBlockText|contains: -recurse selection_file: ScriptBlockText|contains: - .pass - .kdbx - .kdb condition: all of selection_* falsepositives: - Unknown level: medium
Query: Sigma rule for Detects the execution of the hacktool Rubeus using specific command line flags
Matching passage: Sigma rule: Detects the execution of the hacktool Rubeus using specific command line flags. Logsource: windows / ps_script. Rule: title: HackTool - Rubeus Execution - ScriptBlock id: 3245cd30-e015-40ff-a31d-5cadd5f377ec related: - id: 7ec2c172-dceb-4c10-92c9-87c1881b7e18 type: similar status: test description: Detects the execution of the hacktool Rubeus using specific command line flags references: - https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html - https://github.com/GhostPack/Rubeus author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-04-27 tags: - attack.credential-access - attack.t1003 - attack.t1558.003 - attack.lateral-movement - attack.t1550.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'asreproast ' - 'dump /service:krbtgt ' - dump /luid:0x - 'kerberoast ' - 'createnetonly /program:' - 'ptt /ticket:' - '/impersonateuser:' - 'renew /ticket:' - 'asktgt /user:' - 'harvest /interval:' - 's4u /user:' - 's4u /ticket:' - 'hash /password:' - 'golden /aes256:' - 'silver /user:' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notep. Logsource: windows / process_creation. Rule: title: Suspicious Cross-User Process Spawn id: d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47 status: experimental description: 'Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1134 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \notepad.exe - \calc.exe - \mspaint.exe - \wordpad.exe - \write.exe filter_main_same_user: User|fieldref: ParentUser filter_optional_user_null: User: null filter_optional_parent_null: ParentUser: null filter_optional_empty_user: - ParentUser: - '' - '-' - User: - '' - '-' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - RunAs usage spawning one of the listed binaries under a different account level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/info.yml
Query: patch priority for CVE-2015-9164
Matching passage: CVE-2015-9164. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, a buffer overread in Playready may occur due to lack of input validation of the buffer size provided by HLOS.
Near-miss passage: CVE-2015-1333. CWE: CWE-119. CVSS: 4.900000095367432. Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
Query: ATT&CK technique for Traffic Signaling
Matching passage: T1205 Traffic Signaling. Tactics: stealth, persistence, command and control. Description: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also
Near-miss passage: T1205.001 Port Knocking. Tactics: stealth, persistence, command and control. Description: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.
Query: common weakness: Improper Neutralization of Alternate XSS Syntax
Matching passage: CWE-87 Improper Neutralization of Alternate XSS Syntax. The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Near-miss passage: CWE-1102 Reliance on Machine-Dependent Data Representation. The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components.
Query: detection rule: Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep
Matching passage: Sigma rule: Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Logsource: linux / process_creation. Rule: title: Mask System Power Settings Via Systemctl id: c172b7b5-f3a1-4af2-90b7-822c63df86cb status: experimental description: 'Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity. ' author: Milad Cheraghi, Nasreddine Bencherchali date: 2025-10-17 references: - https://www.man7.org/linux/man-pages/man1/systemctl.1.html - https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/ tags: - attack.persistence - attack.impact - attack.t1653 logsource: category: process_creation product: linux detection: selection_systemctl: Image|endswith: /systemctl CommandLine|contains: ' mask' selection_power_options: CommandLine|contains: - suspend.target - hibernate.target - hybrid-sleep.target condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR+ Launcher id: 27aec9c9-dbb0-4939-8422-1742242471d0 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: cmd.{0,5}(?:/c|/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\" condition: selection falsepositives: - Unknown level: high
Query: how to detect Masquerade Account Name
Matching passage: T1036.010 Masquerade Account Name. Tactics: stealth. Description: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023) Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management.(Citation: Elastic CUBA Ransomware 2022)(Citation: Aquasec Kubernetes Attack 2023) They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.”(Citation: Invictus IR Cloud Ransomware 2024) Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to [Account Discovery](https://attack.mitre.org/techniques/T1087). Note that this is distinct from [Impersonation](https://attack.mitre.org/techniques/T1684/001), which describes impersonating specific trusted individuals or organizations, rather than user or service account names.
Near-miss passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)