alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects a flashplayer update from an unofficial location
Matching passage: Sigma rule: Detects a flashplayer update from an unofficial location. Logsource: proxy. Rule: title: Flash Player Update from Suspicious Location id: 4922a5dd-6743-4fc2-8e81-144374280997 status: test description: Detects a flashplayer update from an unofficial location references: - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb author: Florian Roth (Nextron Systems) date: 2017-10-25 modified: 2022-08-08 tags: - attack.initial-access - attack.stealth - attack.t1189 - attack.execution - attack.t1204.002 - attack.t1036.005 logsource: category: proxy detection: selection: - c-uri|contains: /flash_install.php - c-uri|endswith: /install_flash_player.exe filter: cs-host|endswith: .adobe.com condition: selection and not filter falsepositives: - Unknown flash download locations level: high
Near-miss passage: Sigma rule: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Alternate Data Stream Execution id: 6b369ced-4b1d-48f1-b427-fdc0de0790bd status: test description: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-12-31 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Very Possible level: medium
Query: alert when Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate D
Matching passage: Sigma rule: Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate D. Logsource: windows / image_load. Rule: title: System Control Panel Item Loaded From Uncommon Location id: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde status: test description: 'Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques. ' references: - https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ - https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/ - https://github.com/mhaskar/FsquirtCPLPoC - https://securelist.com/sidewinder-apt/114089/ author: Anish Bogati date: 2024-01-09 modified: 2026-02-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \appwiz.cpl - \bthprops.cpl - \hdwwiz.cpl filter_main_legit_location: ImageLoaded|startswith: - C:\Windows\Prefetch\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml
Near-miss passage: Sigma rule: Detects when an the Administrator role is assigned to an user or group.. Logsource: okta / okta. Rule: title: Okta Admin Role Assigned to an User or Group id: 413d4a81-6c98-4479-9863-014785fd579c status: test description: Detects when an the Administrator role is assigned to an user or group. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.003 logsource: product: okta service: okta detection: selection: eventType: - group.privilege.grant - user.account.privilege.grant condition: selection falsepositives: - Administrator roles could be assigned to users or group by other admin users. level: medium
Query: exploit BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.
Matching passage: CVE-2015-2846. CWE: CWE-77. CVSS: 9.300000190734863. BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.
Near-miss passage: CVE-2015-0778. CWE: CWE-77. CVSS: 7.5. osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
Query: detect Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M in logs
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M. Logsource: m365 / threat_management. Rule: title: Suspicious OAuth App File Download Activities id: ee111937-1fe7-40f0-962a-0eb44d57d174 status: test description: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious OAuth app file download activities status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Identifies when secrets are modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Keyvault Secrets Modified or Deleted id: b831353c-1971-477b-abb6-2828edc3bca1 status: test description: Identifies when secrets are modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: rule covering Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan
Matching passage: Sigma rule: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan. Logsource: windows / process_creation. Rule: title: Suspicious Chromium Browser Instance Executed With Custom Extension id: 27ba3207-dd30-4812-abbf-5d20c57d474e related: - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 type: similar status: test description: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml
Near-miss passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / activitylogs. Rule: title: Azure Subscription Permission Elevation Via ActivityLogs id: 09438caa-07b1-4870-8405-1dbafe3dad95 status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION condition: selection falsepositives: - If this was approved by System Administrator. level: high
Query: vulnerability: WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7098. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Query: Encoded PowerShell / command-line abuse matching Login Items
Matching passage: T1547.015 Login Items. Tactics: persistence, privilege escalation. Description: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call <code>SMLoginItemSetEnabled</code>. Login items installed using the Service Management Framework leverage <code>launchd</code>, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications. Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as <code>tell application “System Events” to make login item at end with properties /path/to/executable</code>.
Near-miss passage: T1547.005 Security Support Provider. Tactics: persistence, privilege escalation. Description: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
Query: CVE similar to CVE-2015-6818
Matching passage: CVE-2015-6818. CWE: CWE-17. CVSS: 7.5. The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.
Near-miss passage: CVE-2015-1084. CWE: CWE-17. CVSS: 5.0. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
Query: patch priority for CVE-2015-7908
Matching passage: CVE-2015-7908. CWE: CWE-200. CVSS: 9.300000190734863. Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
Near-miss passage: CVE-2015-4375. CWE: CWE-200. CVSS: 4.300000190734863. The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Query: write Sigma for Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP se
Matching passage: Sigma rule: Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP se. Logsource: windows / process_creation. Rule: title: New Generic Credentials Added Via Cmdkey.EXE id: b1ec66c6-f4d1-4b5c-96dd-af28ccae7727 status: test description: 'Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-03 modified: 2024-03-05 tags: - attack.credential-access - attack.t1003.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdkey.exe - OriginalFileName: cmdkey.exe selection_cli_generic: CommandLine|contains|windash: ' -g' selection_cli_user: CommandLine|contains|windash: ' -u' selection_cli_password: CommandLine|contains|windash: ' -p' condition: all of selection_* falsepositives: - Legitimate usage for administration purposes level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/info.yml simulation: - type: atomic-red-team name: RDP to DomainController technique: T1021.001 atomic_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e
Near-miss passage: Sigma rule: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely. Logsource: windows / process_creation. Rule: title: HackTool - SharpImpersonation Execution id: f89b08d0-77ad-4728-817b-9b16c5a69c7a related: - id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 type: similar status: test description: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/ - https://github.com/S3cur3Th1sSh1t/SharpImpersonation author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems) date: 2022-12-27 modified: 2023-02-13 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \SharpImpersonation.exe - OriginalFileName: SharpImpersonation.exe selection_cli: - CommandLine|contains|all: - ' user:' - ' binary:' - CommandLine|contains|all: - ' user:' - ' shellcode:' - CommandLine|contains: - ' technique:CreateProcessAsUserW' - ' technique:ImpersonateLoggedOnuser' condition: 1 of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-0569
Matching passage: CVE-2015-0569. CWE: CWE-787. CVSS: 7.800000190734863. Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter.
Near-miss passage: CVE-2015-0570. CWE: CWE-787. CVSS: 7.800000190734863. Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that uses a long WPS IE element.
Query: patch priority for CVE-2015-7097
Matching passage: CVE-2015-7097. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-6979. CWE: CWE-119. CVSS: 9.300000190734863. GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: CVE similar to CVE-2015-8299
Matching passage: CVE-2015-8299. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.
Near-miss passage: CVE-2015-8385. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: describe CVE-2015-0073
Matching passage: CVE-2015-0073. CWE: CWE-264. CVSS: 7.199999809265137. The Windows Registry Virtualization feature in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict changes to virtual stores, which allows local users to gain privileges via a crafted application, aka "Registry Virtualization Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-3335. CWE: CWE-264. CVSS: 7.5. The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Query: SIEM correlation: reconnaissance activity consistent with Search Open Websites/Domains
Matching passage: T1593 Search Open Websites/Domains. Tactics: reconnaissance. Description: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1593.001 Social Media. Tactics: reconnaissance. Description: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).