alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary
Matching passage: Sigma rule: Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution id: a20391f8-76fb-437b-abc0-dba2df1952c6 related: - id: 65c3ca2c-525f-4ced-968e-246a713d164f type: similar status: test description: Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection falsepositives: - Legitimate use by developers as part of NodeJS development with Visual Studio Tools level: medium
Near-miss passage: Sigma rule: Detects suspicious mshta process execution patterns. Logsource: windows / process_creation. Rule: title: Suspicious Mshta.EXE Execution Patterns id: e32f92d1-523e-49c3-9374-bdb13b46a3ba status: test description: Detects suspicious mshta process execution patterns references: - https://en.wikipedia.org/wiki/HTML_Application - https://www.echotrail.io/insights/search/mshta.exe - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-17 modified: 2023-02-21 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_susp: ParentImage|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe CommandLine|contains: - \AppData\Local\ - C:\ProgramData\ - C:\Users\Public\ - C:\Windows\Temp\ filter_img: - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - CommandLine|contains: - .htm - .hta - CommandLine|endswith: - mshta.exe - mshta condition: all of selection_* or (selection_img and not filter_img) falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0451
Matching passage: CVE-2015-0451. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 3.0-04 allows remote authenticated users to affect confidentiality via vectors related to OpenSSO Web Agents.
Near-miss passage: CVE-2015-7744. CWE: UNKNOWN. CVSS: 5.900000095367432. wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Query: weakness Incorrect Use of Privileged APIs
Matching passage: CWE-648 Incorrect Use of Privileged APIs. The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
Near-miss passage: CWE-588 Attempt to Access Child of a Non-structure Pointer. Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.
Query: CVE similar to CVE-2015-6378
Matching passage: CVE-2015-6378. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943.
Near-miss passage: CVE-2015-2701. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.
Query: detect Services Registry Permissions Weakness
Matching passage: T1574.011 Services Registry Permissions Weakness. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\Services</code>. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service) If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Adversaries may also alter other Registry keys in the service’s Registry tree. For example, the <code>FailureCommand</code> key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) The <code>Performance</code> key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the <code>Performance</code> key is not already present and if an adversary-con
Near-miss passage: T1574 Hijack Execution Flow. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Query: patch priority for CVE-2015-2263
Matching passage: CVE-2015-2263. CWE: CWE-264. CVSS: 3.299999952316284. Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.
Near-miss passage: CVE-2015-2828. CWE: CWE-264. CVSS: 9.0. CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via crafted object data.
Query: patch priority for CVE-2015-6290
Matching passage: CVE-2015-6290. CWE: CWE-119. CVSS: 4.300000190734863. Cisco Web Security Appliance (WSA) 8.0.7 allows remote HTTP servers to cause a denial of service (memory consumption from stale TCP connections) via crafted responses, aka Bug ID CSCuw10426.
Near-miss passage: CVE-2015-3632. CWE: CWE-119. CVSS: 4.300000190734863. Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted GIF in a PDF file.
Query: detection rule: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to per
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to per. Logsource: m365 / threat_management. Rule: title: Data Exfiltration to Unsanctioned Apps id: 2b669496-d215-47d8-bd9a-f4a45bf07cda status: test description: Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Data exfiltration to unsanctioned apps status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p. Logsource: windows / process_creation. Rule: title: New Capture Session Launched Via DXCap.EXE id: 60f16a96-db70-42eb-8f76-16763e333590 status: test description: 'Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/ - https://twitter.com/harr0ey/status/992008180904419328 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2022-06-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \DXCap.exe - OriginalFileName: DXCap.exe selection_cli: CommandLine|contains: ' -c ' condition: all of selection* falsepositives: - Legitimate execution of dxcap.exe by legitimate user level: medium
Query: mitigate Silver Ticket
Matching passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Near-miss passage: T1558 Steal or Forge Kerberos Tickets. Tactics: credential access. Description: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Query: write Sigma for Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing website
Matching passage: Sigma rule: Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing website. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Mega.nz id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4 status: test description: 'Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads. ' references: - https://megatools.megous.com/ - https://www.mandiant.com/resources/russian-targeting-gov-business author: Florian Roth (Nextron Systems) date: 2021-12-06 modified: 2024-05-31 tags: - attack.exfiltration - attack.t1567.002 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - mega.co.nz - mega.nz condition: selection falsepositives: - Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool. level: low
Near-miss passage: Sigma rule: Detects service installation in suspicious folder appdata. Logsource: windows / system. Rule: title: Service Installation in Suspicious Folder id: 5e993621-67d4-488a-b9ae-b420d08b96cb status: test description: Detects service installation in suspicious folder appdata author: pH-T (Nextron Systems) references: - Internal Research date: 2022-03-18 modified: 2024-01-18 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - \AppData\ - \\\\127.0.0.1 - \\\\localhost filter_optional_zoom: ServiceName: Zoom Sharing Service ImagePath|contains: :\Program Files\Common Files\Zoom\Support\CptService.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: alert when Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection ch
Matching passage: Sigma rule: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection ch. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Encoded Command Patterns id: b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c status: test description: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_flags: CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' selection_encoded: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aWV4I' - ' IAB' - ' PAA' - ' aQBlAHgA' filter_gcworker: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Other tools that work with encoded scripts in the command line instead of script files level: high
Near-miss passage: Sigma rule: Detects image load events with revoked certificates by code integrity.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Revoked Image Loaded id: 881b7725-47cc-4055-8000-425823344c59 status: test description: Detects image load events with revoked certificates by code integrity. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3032 - 3035 condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-2245
Matching passage: CVE-2015-2245. CWE: CWE-20. CVSS: 7.5. Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash).
Near-miss passage: CVE-2015-1135. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1134.
Query: Sigma rule for Detects suspicious and uncommon child processes of WmiPrvSE
Matching passage: Sigma rule: Detects suspicious and uncommon child processes of WmiPrvSE. Logsource: windows / process_creation. Rule: title: Suspicious WmiPrvSE Child Process id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 related: - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d type: similar - id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4 type: obsolete status: test description: Detects suspicious and uncommon child processes of WmiPrvSE references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/ForensicITGuy/status/1334734244120309760 author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) date: 2021-08-23 modified: 2023-11-10 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: \wbem\WmiPrvSE.exe selection_children_1: Image|endswith: - \certutil.exe - \cscript.exe - \mshta.exe - \msiexec.exe - \regsvr32.exe - \rundll32.exe - \verclsid.exe - \wscript.exe selection_children_2: Image|endswith: \cmd.exe CommandLine|contains: - cscript - mshta - powershell - pwsh - regsvr32 - rundll32 - wscript filter_main_werfault: Image|endswith: \WerFault.exe filter_main_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_main_msiexec: Image|endswith: \msiexec.exe CommandLine|contains: '/i ' condition: selection_parent and 1 of selection_children_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such a. Logsource: windows / process_creation. Rule: title: Computer System Reconnaissance Via Wmic.EXE id: 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f status: test description: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-08 modified: 2023-02-14 tags: - attack.discovery - attack.execution - attack.t1047 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: computersystem condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem/info.yml
Query: describe CVE-2015-7919
Matching passage: CVE-2015-7919. CWE: CWE-264. CVSS: 10.0. SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
Near-miss passage: CVE-2015-1489. CWE: CWE-264. CVSS: 8.5. The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.
Query: describe CVE-2015-5222
Matching passage: CVE-2015-5222. CWE: CWE-264. CVSS: 8.5. Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
Near-miss passage: CVE-2015-8965. CWE: CWE-264. CVSS: 9.800000190734863. Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.
Query: describe CVE-2015-8841
Matching passage: CVE-2015-8841. CWE: CWE-787. CVSS: 9.800000190734863. Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
Near-miss passage: CVE-2015-5098. CWE: CWE-787. CVSS: 10.0. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5096 and CVE-2015-5105.
Query: SOC alert related to Communication Through Removable Media
Matching passage: T1092 Communication Through Removable Media. Tactics: command and control. Description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Near-miss passage: T1573.001 Symmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.