alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-6851
Matching passage: CVE-2015-6851. CWE: CWE-284. CVSS: 6.699999809265137. EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector.
Near-miss passage: CVE-2015-3116. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3125, and CVE-2015-5116.
Query: CVE similar to CVE-2015-7810
Matching passage: CVE-2015-7810. CWE: CWE-367. CVSS: 4.699999809265137. libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files
Near-miss passage: CVE-2015-1743. CWE: CWE-367. CVSS: 5.099999904632568. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1748.
Query: playbook for alert: Lateral movement indicators for Social Media Accounts
Matching passage: Playbook for T1585.001 Social Media Accounts. 1) Validate alert telemetry against T1585.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating
Near-miss passage: Playbook for T1585.003 Cloud Accounts. Different response path focused on resource development.
Query: patch priority for CVE-2015-5103
Matching passage: CVE-2015-5103. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-8028. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or (2) Flic Animation file.
Query: vulnerability: PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Matching passage: CVE-2015-0989. CWE: CWE-19. CVSS: 4.300000190734863. PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Near-miss passage: CVE-2015-3225. CWE: CWE-19. CVSS: 5.0. lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Query: CVE similar to CVE-2015-2627
Matching passage: CVE-2015-2627. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation.
Near-miss passage: CVE-2015-8812. CWE: UNKNOWN. CVSS: 9.800000190734863. drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
Query: CVE similar to CVE-2015-0891
Matching passage: CVE-2015-0891. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7460. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356.
Query: patch priority for CVE-2015-2617
Matching passage: CVE-2015-2617. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition.
Near-miss passage: CVE-2015-8420. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: alert when Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hi
Matching passage: Sigma rule: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hi. Logsource: windows / process_creation. Rule: title: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 related: - id: 98c5aeef-32d5-492f-b174-64a691896d25 type: similar - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable. references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings author: Jonhnathan Ribeiro, oscd.community date: 2020-10-16 modified: 2023-02-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sdset: CommandLine|contains|all: - sdset - D; selection_trustee: CommandLine|contains: - ;IU - ;SU - ;BA - ;SY - ;WD condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Stdin - PowerShell Module id: c72aca44-8d52-45ad-8f81-f96c4d3c755e related: - id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 type: derived status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)(set).*&&\s?set.*(environment|invoke|\$?\{?input).*&&.*" condition: selection_4103 falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-2503
Matching passage: CVE-2015-2503. CWE: CWE-264. CVSS: 9.300000190734863. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-5252. CWE: CWE-264. CVSS: 7.199999809265137. vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
Query: describe CVE-2015-0482
Matching passage: CVE-2015-0482. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices.
Near-miss passage: CVE-2015-0356. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Query: risk of The CBSharedReviewCloseDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrob
Matching passage: CVE-2015-6719. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBSharedReviewCloseDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-0438. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Query: patch priority for CVE-2015-4603
Matching passage: CVE-2015-4603. CWE: UNKNOWN. CVSS: 9.800000190734863. The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Near-miss passage: CVE-2015-4857. CWE: UNKNOWN. CVSS: 5.5. Unspecified vulnerability in the RDBMS component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Query: telemetry for T1585.002
Matching passage: T1585.002 Email Accounts. Tactics: resource development. Description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
Near-miss passage: T1585 Establish Accounts. Tactics: resource development. Description: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
Query: patch priority for CVE-2015-7888
Matching passage: CVE-2015-7888. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.
Near-miss passage: CVE-2015-4670. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
Query: exploit Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers t
Matching passage: CVE-2015-3644. CWE: CWE-284. CVSS: 5.800000190734863. Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
Near-miss passage: CVE-2015-3806. CWE: CWE-284. CVSS: 7.199999809265137. Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.
Query: patch priority for CVE-2015-8612
Matching passage: CVE-2015-8612. CWE: CWE-264. CVSS: 8.399999618530273. The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Near-miss passage: CVE-2015-1814. CWE: CWE-264. CVSS: 7.5. The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Query: risk of Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-afte
Matching passage: CVE-2015-4510. CWE: CWE-362. CVSS: 6.800000190734863. Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation.
Near-miss passage: CVE-2015-1865. CWE: CWE-362. CVSS: 5.099999904632568. fts.c in coreutils 8.4 allows local users to delete arbitrary files.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen. Logsource: windows / process_creation. Rule: title: Suspicious Velociraptor Child Process id: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c status: experimental description: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. references: - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-08-29 tags: - attack.command-and-control - attack.persistence - attack.t1219 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \Velociraptor.exe selection_child_vscode_tunnel: CommandLine|contains|all: - code.exe - tunnel - --accept-server-license-terms selection_child_msiexec: CommandLine|contains|all: - msiexec - /i - http selection_child_powershell: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe CommandLine|contains: - 'Invoke-WebRequest ' - 'IWR ' - .DownloadFile - .DownloadString condition: selection_parent and 1 of selection_child_* falsepositives: - Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts. level: high
Near-miss passage: Sigma rule: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.. Logsource: windows / process_creation. Rule: title: Portable Gpg.EXE Execution id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41 status: test description: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data. references: - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a - https://securelist.com/locked-out/68960/ - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-06 modified: 2023-11-10 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \gpg.exe - \gpg2.exe - OriginalFileName: gpg.exe - Description: GnuPG’s OpenPGP tool filter_main_legit_location: Image|contains: - :\Program Files (x86)\GNU\GnuPG\bin\ - :\Program Files (x86)\GnuPG VS-Desktop\ - :\Program Files (x86)\GnuPG\bin\ - :\Program Files (x86)\Gpg4win\bin\ condition: selection and not 1 of filter_main_* level: medium
Query: patch priority for CVE-2015-7251
Matching passage: CVE-2015-7251. CWE: CWE-255. CVSS: 9.800000190734863. ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.
Near-miss passage: CVE-2015-3001. CWE: CWE-255. CVSS: 5.0. SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
Query: write Sigma for Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of
Matching passage: Sigma rule: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of. Logsource: windows / image_load. Rule: title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d status: experimental description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File. references: - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/ - https://x.com/Threatlabz/status/1879956781360976155 author: X__Junior date: 2025-01-20 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: \clfs.sys selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ - Image|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects file execution using the msdeploy.exe lolbin. Logsource: windows / process_creation. Rule: title: Execute Files with Msdeploy.exe id: 646bc99f-6682-4b47-a73a-17b1b64c9d34 status: test description: Detects file execution using the msdeploy.exe lolbin references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/ - https://twitter.com/pabraeken/status/995837734379032576 - https://twitter.com/pabraeken/status/999090532839313408 author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - verb:sync - -source:RunCommand - -dest:runCommand Image|endswith: \msdeploy.exe condition: selection falsepositives: - System administrator Usage level: medium