alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🔸 - 🔹 - 🔶 - 🔷 - 🔳 - 🔲 - ▪️ - ▫️ - ◾️ - ◽️ - ◼️ - ◻️ - 🟥 - 🟧 - 🟨 - 🟩 - 🟦 - 🟪 - ⬛️ - ⬜️ - 🟫 - 🔈 - 🔇 - 🔉 - 🔊 - 🔔 - 🔕 - 📣 - 📢 - 👁‍🗨 - 💬 - 💭 - 🗯 - ♠️ - ♣️ - ♥️ - ♦️ - 🃏 - 🎴 - 🀄️ - 🕐 - 🕑 - 🕒 - 🕓 - 🕔 - 🕕 - 🕖 - 🕗 - 🕘 - 🕙 - 🕚 - 🕛 - 🕜 - 🕝 - 🕞 - 🕟 - 🕠 - 🕡 - 🕢 - 🕣 - 🕤 - 🕥 - 🕦 - 🕧✢ - ✣ - ✤ - ✥ - ✦ - ✧ - ★ - ☆ - ✯ - ✡︎ - ✩ - ✪ - ✫ - ✬ - ✭ - ✮ - ✶ - ✷ - ✵ - ✸ - ✹ - → - ⇒ - ⟹ - ⇨ - ⇾ - ➾ - ⇢ - ☛ - ☞ - ➔ - ➜ - ➙ - ➛ - ➝ - ➞ - ♠︎ - ♣︎ - ♥︎ - ♦︎ - ♤ - ♧ - ♡ - ♢ - ♚ - ♛ - ♜ - ♝ - ♞ - ♟ - ♔ - ♕ - ♖ - ♗ - ♘ - ♙ - ⚀ - ⚁ - ⚂ - ⚃ - ⚄ - ⚅ - 🂠 - ⚈ - ⚉ - ⚆ - ⚇ - 𓀀 - 𓀁 - 𓀂 - 𓀃 - 𓀄 - 𓀅 - 𓀆 - 𓀇 - 𓀈 - 𓀉 - 𓀊 - 𓀋 - 𓀌 - 𓀍 - 𓀎 - 𓀏 - 𓀐 - 𓀑 - 𓀒 - 𓀓 - 𓀔 - 𓀕 - 𓀖 - 𓀗 - 𓀘 - 𓀙 - 𓀚 - 𓀛 - 𓀜 - 𓀝🏳️ - 🏴 - 🏁 - 🚩 - 🏳️‍🌈 - 🏳️‍⚧️ - 🏴‍☠️ - 🇦🇫 - 🇦🇽 - 🇦🇱 - 🇩🇿 - 🇦🇸 - 🇦🇩 - 🇦🇴 - 🇦🇮 - 🇦🇶 - 🇦🇬 - 🇦🇷 - 🇦🇲 - 🇦🇼 - 🇦🇺 - 🇦🇹 - 🇦🇿 - 🇧🇸 - 🇧🇭 - 🇧🇩 - 🇧🇧 - 🇧🇾 - 🇧🇪 - 🇧🇿 - 🇧🇯 - 🇧🇲 - 🇧🇹 - 🇧🇴 - 🇧🇦 - 🇧🇼 - 🇧🇷 - 🇮🇴 - 🇻🇬 - 🇧🇳 - 🇧🇬 - 🇧🇫 - 🇧🇮 - 🇰🇭 - 🇨🇲 - 🇨🇦 - 🇮🇨 - 🇨🇻 - 🇧🇶 - 🇰🇾 - 🇨🇫 - 🇹🇩 - 🇨🇱 - 🇨🇳 - 🇨🇽 - 🇨🇨 - 🇨🇴 - 🇰🇲 - 🇨🇬 - 🇨🇩 - 🇨🇰 - 🇨🇷 - 🇨🇮 - 🇭🇷 - 🇨🇺 - 🇨🇼 - 🇨🇾 - 🇨🇿 - 🇩🇰 - 🇩🇯 - 🇩🇲 - 🇩🇴 - 🇪🇨 - 🇪🇬 - 🇸🇻 - 🇬🇶 - 🇪🇷 - 🇪🇪 - 🇪🇹 - 🇪🇺 - 🇫🇰 - 🇫🇴 - 🇫🇯 - 🇫🇮 - 🇫🇷 - 🇬🇫 - 🇵🇫 - 🇹🇫 - 🇬🇦 - 🇬🇲 - 🇬🇪 - 🇩🇪 - 🇬🇭 - 🇬🇮 - 🇬🇷 - 🇬🇱 - 🇬🇩 - 🇬🇵 - 🇬🇺 - 🇬🇹 - 🇬🇬 - 🇬🇳 - 🇬🇼 - 🇬🇾 - 🇭🇹 - 🇭🇳 - 🇭🇰 - 🇭🇺 - 🇮🇸 - 🇮🇳 - 🇮🇩 - 🇮🇷 - 🇮🇶 - 🇮🇪 - 🇮🇲 - 🇮🇱 - 🇮🇹 - 🇯🇲 - 🇯🇵 - 🎌 - 🇯🇪 - 🇯🇴 - 🇰🇿 - 🇰🇪 - 🇰🇮 - 🇽🇰 - 🇰🇼 - 🇰🇬 - 🇱🇦 - 🇱🇻 - 🇱🇧 - 🇱🇸 - 🇱🇷 - 🇱🇾 - 🇱🇮 - 🇱🇹 - 🇱🇺 - 🇲🇴 - 🇲🇰 - 🇲🇬 - 🇲🇼 - 🇲🇾 - 🇲🇻 - 🇲🇱 - 🇲🇹 - 🇲🇭 - 🇲🇶 - 🇲🇷 - 🇲🇺 - 🇾🇹 - 🇲🇽 - 🇫🇲 - 🇲🇩 - 🇲🇨 - 🇲🇳 - 🇲🇪 - 🇲🇸 - 🇲🇦 - 🇲🇿 - 🇲🇲 - 🇳🇦 - 🇳🇷 - 🇳🇵 - 🇳🇱 - 🇳🇨 - 🇳🇿 - 🇳🇮 - 🇳🇪 - 🇳🇬 - 🇳🇺 - 🇳🇫 - 🇰🇵 - 🇲🇵 - 🇳🇴 - 🇴🇲 - 🇵🇰 - 🇵🇼 - 🇵🇸 - 🇵🇦 - 🇵🇬 - 🇵🇾 - 🇵🇪 - 🇵🇭 - 🇵🇳 - 🇵🇱 - 🇵🇹 - 🇵🇷 - 🇶🇦 - 🇷🇪 - 🇷🇴 - 🇷🇺 - 🇷🇼 - 🇼🇸 - 🇸🇲 - 🇸🇦 - 🇸🇳 - 🇷🇸 - 🇸🇨 - 🇸🇱 - 🇸🇬 - 🇸🇽 - 🇸🇰 - 🇸🇮 - 🇬🇸 - 🇸🇧 - 🇸🇴 - 🇿🇦 - 🇰🇷 - 🇸🇸 - 🇪🇸 - 🇱🇰 - 🇧🇱 - 🇸🇭 - 🇰🇳 - 🇱🇨 - 🇵🇲 - 🇻🇨 - 🇸🇩 - 🇸🇷 - 🇸🇿 - 🇸🇪 - 🇨🇭 - 🇸🇾 - 🇹🇼 - 🇹🇯 - 🇹🇿 - 🇹🇭 - 🇹🇱 - 🇹🇬 - 🇹🇰 - 🇹🇴 - 🇹🇹 - 🇹🇳 - 🇹🇷 - 🇹🇲 - 🇹🇨 - 🇹🇻 - 🇻🇮 - 🇺🇬 - 🇺🇦 - 🇦🇪 - 🇬🇧 - 🏴󠁧󠁢󠁥󠁮󠁧󠁿 - 🏴󠁧󠁢󠁳󠁣󠁴󠁿 - 🏴󠁧󠁢󠁷󠁬󠁳󠁿 - 🇺🇳 - 🇺🇸 - 🇺🇾 - 🇺🇿 - 🇻🇺 - 🇻🇦 - 🇻🇪 - 🇻🇳 - 🇼🇫 - 🇪🇭 - 🇾🇪 - 🇿🇲 - 🇿🇼🫠 - 🫢 - 🫣 - 🫡 - 🫥 - 🫤 - 🥹 - 🫱 - 🫱🏻 - 🫱🏼 - 🫱🏽 - 🫱🏾 - 🫱🏿 - 🫲 - 🫲🏻 - 🫲🏼 - 🫲🏽
Sigma rule: Detects remote RPC calls to read information about scheduled tasks. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Recon via ITaskSchedulerService id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e status: test description: Detects remote RPC calls to read information about scheduled tasks references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c filter: OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module id: a136cde0-61ad-4a61-9b82-8dc490e60dd2 related: - id: 73e67340-0d25-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4103 falsepositives: - Unknown level: high
Sigma rule: Detects when unauthorized access to app occurs.. Logsource: okta / okta. Rule: title: Okta Unauthorized Access to App id: 6cc2b61b-d97e-42ef-a9dd-8aa8dc951657 status: test description: Detects when unauthorized access to app occurs. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: displayMessage: User attempted unauthorized access to app condition: selection falsepositives: - User might of believe that they had access. level: medium
Sigma rule: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Shebang In CLI id: fe2f9663-41cb-47e2-b954-8a228f3b9dff status: test description: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - IyEvYmluL2Jhc2 - IyEvYmluL2Rhc2 - IyEvYmluL3pza - IyEvYmluL2Zpc2 - IyEvYmluL3No condition: selection falsepositives: - Legitimate administration activities level: medium
Sigma rule: Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Visual Studio Code Tunnels Domain id: 4b657234-038e-4ad5-997c-4be42340bce4 related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://cydefops.com/vscode-data-exfiltration author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .tunnels.api.visualstudio.com condition: selection falsepositives: - Legitimate use of Visual Studio Code tunnel will also trigger this. level: medium
Sigma rule: Detects buffer overflow attempts in Unix system log files. Logsource: linux. Rule: title: Buffer Overflow Attempts id: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781 status: test description: Detects buffer overflow attempts in Unix system log files references: - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml - https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html - https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802 - https://blu.org/mhonarc/discuss/2001/04/msg00285.php - https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/ author: Florian Roth (Nextron Systems) date: 2017-03-01 modified: 2025-03-17 tags: - attack.t1068 - attack.privilege-escalation logsource: product: linux detection: keywords: - attempt to execute code on stack by - 0bin0sh1 - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - stack smashing detected condition: keywords falsepositives: - Base64 encoded data in log entries level: high
Sigma rule: Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existenc. Logsource: windows / process_creation. Rule: title: Webshell Tool Reconnaissance Activity id: f64e5c19-879c-4bae-b471-6d84c8339677 status: test description: 'Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands ' references: - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html author: Cian Heasley, Florian Roth (Nextron Systems) date: 2020-07-22 modified: 2023-11-09 tags: - attack.persistence - attack.t1505.003 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \w3wp.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - CATALINA_HOME - catalina.jar selection_recon: CommandLine|contains: - perl --help - perl -h - python --help - python -h - python3 --help - python3 -h - wget --help condition: 1 of selection_webserver_* and selection_recon falsepositives: - Unknown level: high
Sigma rule: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" reg. Logsource: windows / registry_set. Rule: title: Old TLS1.0/TLS1.1 Protocol Version Enabled id: 439957a7-ad86-4a8f-9705-a28131c6821b status: test description: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key. references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\ - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\ TargetObject|endswith: \Enabled Details: DWORD (0x00000001) condition: selection falsepositives: - Legitimate enabling of the old tls versions due to incompatibility level: medium
Sigma rule: Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process. Logsource: windows / registry_event. Rule: title: Potential Credential Dumping Via LSASS SilentProcessExit Technique id: 55e29995-75e7-451a-bef0-6225e2f13597 related: - id: 36803969-5421-41ec-b92f-8500f79c23b0 type: similar status: test description: Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process references: - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/ - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ author: Florian Roth (Nextron Systems) date: 2021-02-26 modified: 2022-12-19 tags: - attack.credential-access - attack.t1003.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools. Logsource: windows / process_creation. Rule: title: Suspicious RunAs-Like Flag Combination id: 50d66fb0-03f8-4da0-8add-84e77d12a020 status: test description: Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools references: - https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html author: Florian Roth (Nextron Systems) date: 2022-11-11 tags: - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_user: CommandLine|contains: - ' -u system ' - ' --user system ' - ' -u NT' - ' -u "NT' - ' -u ''NT' - ' --system ' - ' -u administrator ' selection_command: CommandLine|contains: - ' -c cmd' - ' -c "cmd' - ' -c powershell' - ' -c "powershell' - ' --command cmd' - ' --command powershell' - ' -c whoami' - ' -c wscript' - ' -c cscript' condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via Windows Authentication id: 6e78f90f-0043-4a01-ac41-f97681613a66 status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9002 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated. Logsource: azure / auditlogs. Rule: title: Temporary Access Pass Added To An Account id: fa84aaf5-8142-43cd-9ec2-78cfebf878ce status: test description: Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-10 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Admin registered security info Status: Admin registered temporary access pass method for user condition: selection falsepositives: - Administrator adding a legitimate temporary access pass level: high
Sigma rule: Detects suspicious service installation commands. Logsource: windows / system. Rule: title: Suspicious Service Installation id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 26481afe-db26-4228-b264-25a29fe6efc7 type: similar status: test description: Detects suspicious service installation commands references: - Internal Research author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2023-12-04 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - ' -nop ' - ' -sta ' - ' -w hidden ' - :\Temp\ - .downloadfile( - .downloadstring( - \ADMIN$\ - \Perflogs\ - '&&' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share. Logsource: windows / process_creation. Rule: title: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE id: 044ba588-dff4-4918-9808-3f95e8160606 status: test description: Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share references: - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-27 modified: 2023-09-12 tags: - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - 'copy ' - ' \\\\' CommandLine|contains: - .dmp - .dump - .hdmp condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via differe. Logsource: windows / process_creation. Rule: title: Mshtml.DLL RunHTMLApplication Suspicious Usage id: 4782eb5a-a513-4523-a0ac-f3082b26ac5c related: - id: 9f06447a-a33a-4cbe-a94f-a3f43184a7a3 type: obsolete - id: 73fcad2e-ff14-4c38-b11d-4172c8ac86c7 type: obsolete status: test description: 'Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...) ' references: - https://twitter.com/n1nj4sec/status/1421190238081277959 - https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt - http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA) date: 2022-08-14 modified: 2024-02-23 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \..\ - mshtml CommandLine|contains: - '#135' - RunHTMLApplication condition: selection falsepositives: - Unlikely level: high
CVE-2015-0001. CWE: CWE-264. CVSS: 1.899999976158142. The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability."
CVE-2015-0002. CWE: CWE-264. CVSS: 7.199999809265137. The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
CVE-2015-0003. CWE: CWE-476. CVSS: 6.900000095367432. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVE-2015-0004. CWE: CWE-264. CVSS: 7.199999809265137. The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."
CVE-2015-0005. CWE: CWE-254. CVSS: 4.300000190734863. The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability."
CVE-2015-0006. CWE: CWE-264. CVSS: 6.099999904632568. The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
CVE-2015-0008. CWE: CWE-284. CVSS: 8.300000190734863. The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability."
CVE-2015-0009. CWE: CWE-254. CVSS: 3.299999952316284. The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability."
CVE-2015-0010. CWE: CWE-310. CVSS: 1.899999976158142. The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
CVE-2015-0011. CWE: CWE-264. CVSS: 4.699999809265137. mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
CVE-2015-0012. CWE: CWE-264. CVSS: 6.900000095367432. Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability."