alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: intelligence brief on T1218.012
Matching passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Near-miss passage: T1218.013 Mavinject. Tactics: stealth. Description: Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject) Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its <code>/HMODULE</code> command-line parameter (ex. <code>mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER</code>). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)
Query: vulnerability: The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain s
Matching passage: CVE-2015-8776. CWE: CWE-189. CVSS: 9.100000381469727. The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.
Near-miss passage: CVE-2015-1258. CWE: CWE-189. CVSS: 7.5. Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.. Logsource: windows / registry_set. Rule: title: Microsoft Office Protected View Disabled id: a5c7a43f-6009-4a8c-80c5-32abf1c53ecc related: - id: 7c637634-c95d-4bbf-b26c-a82510874b34 type: obsolete status: test description: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-08 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_path: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Security\ProtectedView\ selection_values_1: Details: DWORD (0x00000001) TargetObject|endswith: - \DisableAttachementsInPV - \DisableInternetFilesInPV - \DisableIntranetCheck - \DisableUnsafeLocationsInPV selection_values_0: Details: DWORD (0x00000000) TargetObject|endswith: - \enabledatabasefileprotectedview - \enableforeigntextfileprotectedview condition: selection_path and 1 of selection_values_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of the Chisel tunneling tool via the commandline arguments. Logsource: windows / process_creation. Rule: title: PUA - Chisel Tunneling Tool Execution id: 8b0e12da-d3c3-49db-bb4f-256703f380e5 related: - id: cf93e05e-d798-4d9e-b522-b0248dc61eaf type: similar status: test description: Detects usage of the Chisel tunneling tool via the commandline arguments references: - https://github.com/jpillora/chisel/ - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ - https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/ author: Florian Roth (Nextron Systems) date: 2022-09-13 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1090.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \chisel.exe selection_param1: CommandLine|contains: - 'exe client ' - 'exe server ' selection_param2: CommandLine|contains: - -socks5 - -reverse - ' r:' - ':127.0.0.1:' - '-tls-skip-verify ' - :socks condition: selection_img or all of selection_param* falsepositives: - Some false positives may occur with other tools with similar commandlines level: high
Query: indicators of Exploitation for Credential Access
Matching passage: T1212 Exploitation for Credential Access. Tactics: credential access. Description: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.(Citation: Technet MS14-068)(Citation: ADSecurity Detecting Forged Tickets) Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges.(Citation: Bugcrowd Replay Attack)(Citation: Comparitech Replay Attack)(Citation: Microsoft Midnight Blizzard Replay Attack) Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal.(Citation: Storm-0558 techniques for unauthorized email access) Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.
Near-miss passage: T1556 Modify Authentication Process. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
Query: alert when Detects usage of the Sharp Chisel via the commandline arguments
Matching passage: Sigma rule: Detects usage of the Sharp Chisel via the commandline arguments. Logsource: windows / process_creation. Rule: title: HackTool - SharpChisel Execution id: cf93e05e-d798-4d9e-b522-b0248dc61eaf related: - id: 8b0e12da-d3c3-49db-bb4f-256703f380e5 type: similar status: test description: Detects usage of the Sharp Chisel via the commandline arguments references: - https://github.com/shantanu561993/SharpChisel - https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-05 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1090.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpChisel.exe - Product: SharpChisel condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. Logsource: windows / process_creation. Rule: title: Potential Manage-bde.wsf Abuse To Proxy Execution id: c363385c-f75d-4753-a108-c1a8e28bdbda status: test description: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution references: - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/ - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712 - https://twitter.com/bohops/status/980659399495741441 - https://twitter.com/JohnLaTwC/status/1223292479270600706 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2023-02-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_wscript_img: - Image|endswith: \wscript.exe - OriginalFileName: wscript.exe selection_wscript_cli: CommandLine|contains: manage-bde.wsf selection_parent: ParentImage|endswith: - \cscript.exe - \wscript.exe ParentCommandLine|contains: manage-bde.wsf selection_filter_cmd: Image|endswith: \cmd.exe condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd) falsepositives: - Unlikely level: high
Query: describe CVE-2015-5918
Matching passage: CVE-2015-5918. CWE: CWE-119. CVSS: 7.199999809265137. GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5919.
Near-miss passage: CVE-2015-7061. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
Query: CVE similar to CVE-2015-0093
Matching passage: CVE-2015-0093. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0092.
Near-miss passage: CVE-2015-8761. CWE: CWE-94. CVSS: 9.0. The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.
Query: risk of Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
Matching passage: CVE-2015-7273. CWE: CWE-611. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
Near-miss passage: CVE-2015-8866. CWE: CWE-611. CVSS: 9.600000381469727. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Query: alert when Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Repor
Matching passage: Sigma rule: Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Repor. Logsource: windows / process_creation. Rule: title: HackTool - WSASS Execution id: 589ac73f-8e12-409c-964e-31a2f5775ae2 status: experimental description: 'Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER''s (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections. ' references: - https://github.com/TwoSevenOneT/WSASS - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-23 modified: 2026-01-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wsass.exe selection_hash: Hashes|contains: IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42 selection_cli: CommandLine|re: (?i)\.exe[\"\']?\s+[^\"]{0,64}werfaultsecure\.exe[\"\']?\s+\d{2,10} condition: 1 of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml
Near-miss passage: Sigma rule: Detects the use of PowerShell to identify the current logged user.. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Get Current User id: 4096a49c-7de4-4da0-a230-c66ccd56ea5a status: test description: Detects the use of PowerShell to identify the current logged user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script author: frack113 date: 2022-04-04 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - '[System.Environment]::UserName' - $env:UserName - '[System.Security.Principal.WindowsIdentity]::GetCurrent()' condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Query: EDR alert: possible User Activity Based Checks (T1497.002)
Matching passage: T1497.002 User Activity Based Checks. Tactics: stealth, discovery. Description: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017)
Near-miss passage: T1497 Virtualization/Sandbox Evasion. Tactics: stealth, discovery. Description: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)
Query: rule covering Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directo
Matching passage: Sigma rule: Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directo. Logsource: windows / ps_script. Rule: title: HackTool - WinPwn Execution - ScriptBlock id: 851fd622-b675-4d26-b803-14bc7baa517a related: - id: d557dc06-62e8-4468-a8e8-7984124908ce type: similar status: test description: 'Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation. ' author: Swachchhanda Shrawan Poudel date: 2023-12-04 references: - https://github.com/S3cur3Th1sSh1t/WinPwn - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841 - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/ - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team tags: - attack.credential-access - attack.discovery - attack.execution - attack.privilege-escalation - attack.t1046 - attack.t1082 - attack.t1106 - attack.t1518 - attack.t1548.002 - attack.t1552.001 - attack.t1555 - attack.t1555.003 logsource: category: ps_script product: windows definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Offline_Winpwn - 'WinPwn ' - WinPwn.exe - WinPwn.ps1 condition: selection falsepositives: - As the script block is a blob of text. False positive may occur with scripts that contain the keyword as a reference or simply use it for detection. level: high
Near-miss passage: Sigma rule: Identifies when an EKS cluster is created or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS EKS Cluster Created or Deleted id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0 status: test description: Identifies when an EKS cluster is created or deleted. references: - https://any-api.com/amazonaws_com/eks/docs/API_Description author: Austin Songer date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: product: aws service: cloudtrail detection: selection: eventSource: eks.amazonaws.com eventName: - CreateCluster - DeleteCluster condition: selection falsepositives: - EKS Cluster being created or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: CVE similar to CVE-2015-7271
Matching passage: CVE-2015-7271. CWE: CWE-134. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.
Near-miss passage: CVE-2015-8617. CWE: CWE-134. CVSS: 9.800000190734863. Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Query: risk of The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial
Matching passage: CVE-2015-8844. CWE: CWE-20. CVSS: 5.5. The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Near-miss passage: CVE-2015-7893. CWE: CWE-20. CVSS: 8.800000190734863. SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.