alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detec
Matching passage: Sigma rule: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detec. Logsource: macos / process_creation. Rule: title: Scheduled Cron Task/Job - MacOs id: 7c3b43d8-d794-47d2-800a-d277715aa460 status: test description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2022-11-27 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /crontab CommandLine|contains: /tmp/ condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects usage of powershell cmdlets to disable or remove ETW trace sessions. Logsource: windows / ps_script. Rule: title: Disable of ETW Trace - Powershell id: 115fdba9-f017-42e6-84cf-d5573bf2ddf8 related: - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6 type: derived status: test description: Detects usage of powershell cmdlets to disable or remove ETW trace sessions references: - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2022-11-25 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - car.2016-04-002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_pwsh_remove: ScriptBlockText|contains: 'Remove-EtwTraceProvider ' selection_pwsh_set: ScriptBlockText|contains|all: - 'Set-EtwTraceProvider ' - '0x11' condition: 1 of selection* falsepositives: - Unknown level: high
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.. Logsource: windows / file_event. Rule: title: HackTool - Mimikatz Kirbi File Creation id: 9e099d99-44c2-42b6-a6d8-54c3545cab29 related: - id: 034affe8-6170-11ec-844f-0f78aa0c4d66 type: obsolete status: test description: Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc. references: - https://cobalt.io/blog/kerberoast-attack-techniques - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ author: Florian Roth (Nextron Systems), David ANDRE date: 2021-11-08 modified: 2024-06-27 tags: - attack.credential-access - attack.t1558 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .kirbi - mimilsa.log condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacke. Logsource: windows / process_creation. Rule: title: Add SafeBoot Keys Via Reg Utility id: d7662ff6-9e97-4596-a61d-9839e32dee8d related: - id: fc0e89b5-adb0-43c1-b749-c12a10ec37de type: similar status: test description: Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not references: - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-02 modified: 2024-03-19 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_safeboot: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\SafeBoot selection_flag: CommandLine|contains: - ' copy ' - ' add ' condition: all of selection* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_safeboot/info.yml
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Steganography
Matching passage: Playbook for T1027.003 Steganography. 1) Validate alert telemetry against T1027.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hi
Near-miss passage: Playbook for T1027.010 Command Obfuscation. Different response path focused on stealth.
Query: detection rule: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Matching passage: Sigma rule: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Scrobj.dll COM Hijacking id: fe20dda1-6f37-4379-bbe0-a98d400cae90 status: test description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-08-20 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: InprocServer32\(Default) Details: C:\WINDOWS\system32\scrobj.dll condition: selection falsepositives: - Legitimate use of the dll. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation CLIP+ Launcher - Security id: 4edf51e1-cb83-4e1a-bc39-800e396068e3 related: - id: f7385ee2-0e0c-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - '&&' - 'clipboard]::' condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for azure / activitylogs
Matching passage: Sigma rule: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Events Deleted id: 225d8b09-e714-479c-a0e4-55e6f29adf35 status: test description: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-08-23 tags: - attack.defense-impairment - attack.t1685 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE condition: selection falsepositives: - Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects execution of the Notepad++ updater (gup) to launch other commands or executables. Logsource: windows / process_creation. Rule: title: Arbitrary Binary Execution Using GUP Utility id: d65aee4d-2292-4cea-b832-83accd6cfa43 status: test description: Detects execution of the Notepad++ updater (gup) to launch other commands or executables references: - https://twitter.com/nas_bench/status/1535322445439180803 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \gup.exe Image|endswith: \explorer.exe filter: Image|endswith: \explorer.exe CommandLine|contains: \Notepad++\notepad++.exe filter_parent: ParentImage|contains: \Notepad++\updater\ filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Other parent binaries using GUP not currently identified level: medium
Query: vulnerability: hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."
Matching passage: CVE-2015-1610. CWE: CWE-264. CVSS: 5.300000190734863. hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."
Near-miss passage: CVE-2015-2152. CWE: CWE-264. CVSS: 1.899999976158142. Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.. Logsource: windows / process_creation. Rule: title: PowerShell Execution With Potential Decryption Capabilities id: 434c08ba-8406-4d15-8b24-782cb071a691 status: test description: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware. references: - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-06-30 modified: 2023-12-05 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \powershell.exe - \pwsh.exe OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_dir: CommandLine|contains: - 'Get-ChildItem ' - 'dir ' - 'gci ' - 'ls ' selection_cli_gc: CommandLine|contains: - 'Get-Content ' - 'gc ' - 'cat ' - 'type ' - ReadAllBytes selection_cli_specific: - CommandLine|contains|all: - ' ^| ' - \*.lnk - -Recurse - '-Skip ' - CommandLine|contains|all: - ' -ExpandProperty ' - \*.lnk - WriteAllBytes - ' .length ' condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when a user disables the Windows Firewall via a Profile to help evade defense.. Logsource: windows / ps_script. Rule: title: Windows Firewall Profile Disabled id: 488b44e7-3781-4a71-888d-c95abfacf44d related: - id: 12f6b752-042d-483e-bf9c-915a6d06ad75 type: similar status: test description: Detects when a user disables the Windows Firewall via a Profile to help evade defense. references: - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell - https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php - http://woshub.com/manage-windows-firewall-powershell/ - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-30 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_args: ScriptBlockText|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: ScriptBlockText|contains: - ' -All ' - Public - Domain - Private condition: all of selection* falsepositives: - Unknown level: medium
Query: detection rule: Detects value modification of registry key containing path to binary used as screensaver.
Matching passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Near-miss passage: Sigma rule: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools. Logsource: windows / registry_event. Rule: title: Sticky Key Like Backdoor Usage - Registry id: baca5663-583c-45f9-b5dc-ea96a22ce542 status: test description: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen references: - https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/ - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community date: 2018-03-15 modified: 2022-11-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.008 - car.2014-11-003 - car.2014-11-008 logsource: category: registry_event product: windows detection: selection_registry: TargetObject|endswith: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisplaySwitch.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atbroker.exe\Debugger - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger condition: selection_registry falsepositives: - Unlikely level: critical
Query: alert when Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running
Matching passage: Sigma rule: Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running. Logsource: windows / registry_set. Rule: title: Internet Explorer DisableFirstRunCustomize Enabled id: ab567429-1dfb-4674-b6d2-979fd2f9d125 status: test description: 'Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. ' references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-16 modified: 2025-10-07 tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Internet Explorer\Main\DisableFirstRunCustomize Details: - DWORD (0x00000001) - DWORD (0x00000002) filter_main_generic: Image: - C:\Windows\explorer.exe - C:\Windows\System32\ie4uinit.exe filter_optional_avira: Image|contains|all: - \Temp\ - \.cr\avira_ Details|contains: DWORD (0x00000001) filter_optional_foxit: Image: - C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe - C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe Details|contains: DWORD (0x00000001) condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - As this is controlled by group policy as well as user settings. Some false positives may occur. level: medium
Near-miss passage: Sigma rule: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to. Logsource: windows / process_creation. Rule: title: Potential Mftrace.EXE Abuse id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e status: test description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 modified: 2023-08-03 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \mftrace.exe condition: selection falsepositives: - Legitimate use for tracing purposes level: medium
Query: common weakness: Invokable Control Element with Variadic Parameters
Matching passage: CWE-1056 Invokable Control Element with Variadic Parameters. A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments.
Near-miss passage: CWE-446 UI Discrepancy for Security Feature. The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.
Query: patch priority for CVE-2015-1078
Matching passage: CVE-2015-1078. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0027. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0035, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068.
Query: risk of Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administratio
Matching passage: CVE-2015-8965. CWE: CWE-264. CVSS: 9.800000190734863. Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.
Near-miss passage: CVE-2015-5897. CWE: CWE-264. CVSS: 4.599999904632568. The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that rely on this framework.
Query: describe CVE-2015-0189
Matching passage: CVE-2015-0189. CWE: CWE-399. CVSS: 4.0. The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service (memory overwrite and daemon outage) by triggering multiple transmit-queue records.
Near-miss passage: CVE-2015-0052. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0068.
Query: risk of Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Matching passage: CVE-2015-7777. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Near-miss passage: CVE-2015-5475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.