alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects actions taken by Windows Defender malware detection engines in logs
Matching passage: Sigma rule: Detects actions taken by Windows Defender malware detection engines. Logsource: windows / windefend. Rule: title: Windows Defender Threat Detected id: 57b649ef-ff42-4fb0-8bf6-62da243a1708 status: stable description: Detects actions taken by Windows Defender malware detection engines references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus author: Ján Trenčanský date: 2020-07-28 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: - 1006 - 1015 - 1116 - 1117 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common. Logsource: windows / file_event. Rule: title: Suspicious Startup Folder Persistence id: 28208707-fe31-437f-9a7f-4b1108b94d2e related: - id: 2aa0a6b4-a865-495b-ab51-c28249537b75 type: similar status: test description: 'Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems. ' references: - https://github.com/last-byte/PersistenceSniper - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ - https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-08-10 modified: 2025-10-12 tags: - attack.privilege-escalation - attack.execution - attack.t1204.002 - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\Start Menu\Programs\Startup\ TargetFilename|endswith: - .bat - .cmd - .dll - .hta - .jar - .js - .jse - .msi - .ps1 - .psd1 - .psm1 - .scr - .url - .vba - .vbe - .vbs - .wsf condition: selection falsepositives: - Rare legitimate usage of some of the extensions mentioned in the rule level: high
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects possible suspicious glue development endpoint activity.. Logsource: aws / cloudtrail. Rule: title: AWS Glue Development Endpoint Activity id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26 status: test description: Detects possible suspicious glue development endpoint activity. references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html author: Austin Songer @austinsonger date: 2021-10-03 modified: 2022-12-18 tags: - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: glue.amazonaws.com eventName: - CreateDevEndpoint - DeleteDevEndpoint - UpdateDevEndpoint condition: selection falsepositives: - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persi. Logsource: windows / dns_query. Rule: title: DNS Query To Devtunnels Domain id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar status: test description: 'Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security - https://cydefops.com/devtunnels-unleashed author: citron_ninja date: 2023-10-25 modified: 2023-11-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: .devtunnels.ms condition: selection falsepositives: - Legitimate use of Devtunnels will also trigger this. level: medium
Query: vulnerability: The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEdit
Matching passage: CVE-2015-9423. CWE: CWE-79. CVSS: 5.400000095367432. The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
Near-miss passage: CVE-2015-3369. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block.
Query: telemetry for T1090.002
Matching passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Near-miss passage: T1090.004 Domain Fronting. Tactics: command and control. Description: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Query: patch priority for CVE-2015-5023
Matching passage: CVE-2015-5023. CWE: CWE-89. CVSS: 5.400000095367432. SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-4208. CWE: CWE-89. CVSS: 7.5. Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.. Logsource: linux / process_creation. Rule: title: ESXi VM List Discovery Via ESXCLI id: 5f1573a7-363b-4114-9208-ad7a61de46eb status: test description: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/ - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html author: Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains: vm process CommandLine|endswith: ' list' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec. Logsource: windows / security. Rule: title: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54 status: test description: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.credential-access - attack.lateral-movement - attack.privilege-escalation - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4673 Service: LsaRegisterLogonProcess() Keywords: '0x8010000000000000' condition: selection falsepositives: - Unknown level: high
Query: SOC alert related to Serverless
Matching passage: T1584.007 Serverless. Tactics: resource development. Description: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
Near-miss passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Query: mitigate Stored Data Manipulation
Matching passage: T1565.001 Stored Data Manipulation. Tactics: impact. Description: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: rule covering Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Matching passage: Sigma rule: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit. Logsource: windows / msexchange-management. Rule: title: Remove Exported Mailbox from Exchange Webserver id: 09570ae5-889e-43ea-aac0-0e1221fb3d95 status: test description: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430 author: Christian Burkard (Nextron Systems) date: 2021-08-27 modified: 2023-01-23 tags: - attack.stealth - attack.t1070 logsource: service: msexchange-management product: windows detection: keywords: '|all': - Remove-MailboxExportRequest - ' -Identity ' - ' -Confirm "False"' condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects default file names outputted by the BloodHound collection tool SharpHound. Logsource: windows / file_event. Rule: title: BloodHound Collection Files id: 02773bed-83bf-469f-b7ff-e676e7d78bab status: test description: Detects default file names outputted by the BloodHound collection tool SharpHound references: - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection author: C.J. May date: 2022-08-09 modified: 2026-02-19 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 - attack.t1482 - attack.t1069.001 - attack.t1069.002 - attack.execution - attack.t1059.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - BloodHound.zip - _computers.json - _containers.json - _gpos.json - _groups.json - _ous.json - _users.json filter_optional_ms_winapps: Image|endswith: \svchost.exe TargetFilename|startswith: C:\Program Files\WindowsApps\Microsoft. TargetFilename|endswith: \pocket_containers.json condition: selection and not 1 of filter_optional_* falsepositives: - Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise level: high
Query: risk of Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 p
Matching passage: CVE-2015-7827. CWE: CWE-200. CVSS: 7.5. Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
Near-miss passage: CVE-2015-7935. CWE: CWE-200. CVSS: 7.5. Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
Query: risk of Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-0891. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7460. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356.
Query: detect Launchctl
Matching passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1569 System Services. Tactics: execution. Description: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.
Query: write Sigma for Detects when an Network Zone is Deactivated or Deleted.
Matching passage: Sigma rule: Detects when an Network Zone is Deactivated or Deleted.. Logsource: okta / okta. Rule: title: Okta Network Zone Deactivated or Deleted id: 9f308120-69ed-4506-abde-ac6da81f4310 status: test description: Detects when an Network Zone is Deactivated or Deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - zone.deactivate - zone.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is us. Logsource: windows / security. Rule: title: Suspicious PsExec Execution id: c462f537-a1e3-41a6-b5fc-b2c2cef9bf82 status: test description: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one references: - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html author: Samir Bousseaden date: 2019-04-03 modified: 2022-08-11 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName|endswith: - -stdin - -stdout - -stderr filter: RelativeTargetName|startswith: PSEXESVC condition: selection1 and not filter falsepositives: - Unknown level: high
Query: SOC runbook when seeing Lateral movement indicators for Hidden Users
Matching passage: Playbook for T1564.002 Hidden Users. 1) Validate alert telemetry against T1564.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user
Near-miss passage: Playbook for T1564.003 Hidden Window. Different response path focused on stealth.