alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order
Matching passage: Sigma rule: Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order. Logsource: windows / registry_set. Rule: title: Hypervisor Enforced Paging Translation Disabled id: 7f2954d2-99c2-4d42-a065-ca36740f187b status: test description: 'Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature. ' references: - https://twitter.com/standa_t/status/1808868985678803222 - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \DisableHypervisorEnforcedPagingTranslation Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.. Logsource: azure / riskdetection. Rule: title: Anomalous User Activity id: 258b6593-215d-4a26-a141-c8e31c1299a6 status: test description: Indicates that there are anomalous patterns of behavior like suspicious changes to the directory. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.privilege-escalation - attack.t1098 - attack.persistence logsource: product: azure service: riskdetection detection: selection: riskEventType: anomalousUserActivity condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: exploit Lenovo USB Enhanced Performance Keyboard software before 2.0.2.2 includes active debugging code in SKHOOKS.DLL, which allows local users to obtain keypress information by accessing
Matching passage: CVE-2015-3320. CWE: CWE-200. CVSS: 2.0999999046325684. Lenovo USB Enhanced Performance Keyboard software before 2.0.2.2 includes active debugging code in SKHOOKS.DLL, which allows local users to obtain keypress information by accessing debug output.
Near-miss passage: CVE-2015-4503. CWE: CWE-200. CVSS: 5.0. The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Query: describe CVE-2015-3230
Matching passage: CVE-2015-3230. CWE: CWE-254. CVSS: 7.5. 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.
Near-miss passage: CVE-2015-5850. CWE: CWE-254. CVSS: 2.0999999046325684. AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Query: write Sigma for Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Matching passage: Sigma rule: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j). Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by Java.EXE id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d related: - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 type: similar status: test description: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Florian Roth date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \AppVLP.exe - \bitsadmin.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \query.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: high
Near-miss passage: Sigma rule: Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfi. Logsource: aws / cloudtrail. Rule: title: AWS User Login Profile Was Modified id: 055fb148-60f8-462d-ad16-26926ce050f1 status: test description: 'Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. ' references: - https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation author: toffeebr33k date: 2021-08-09 modified: 2024-04-26 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: UpdateLoginProfile filter_main_user_identity: userIdentity.arn|fieldref: requestParameters.userName condition: selection and not 1 of filter_main_* falsepositives: - Legitimate user account administration level: high
Query: patch priority for CVE-2015-8757
Matching passage: CVE-2015-8757. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to extension data during an extension installation.
Near-miss passage: CVE-2015-1565. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the online help in Hitachi Device Manager, Tiered Storage Manager, Replication Manager, and Global Link Manager before 8.1.2-00, and Compute Systems Manager before 7.6.1-08 and 8.x before 8.1.2-00, as used in Hitachi Command Suite, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: CWE for Improper Restriction of Security Token Assignment
Matching passage: CWE-1259 Improper Restriction of Security Token Assignment. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
Near-miss passage: CWE-144 Improper Neutralization of Line Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
Query: vulnerability: The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leveraging administrative privileges for sto
Matching passage: CVE-2015-4244. CWE: CWE-78. CVSS: 7.199999809265137. The boot implementation on Cisco ASR 5000 and 5500 devices with software 14.0 allows local users to execute arbitrary Linux commands by leveraging administrative privileges for storage of these commands in a Compact Flash (CF) file, aka Bug ID CSCuu75278.
Near-miss passage: CVE-2015-7769. CWE: CWE-78. CVSS: 6.300000190734863. baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Query: patch priority for CVE-2015-5785
Matching passage: CVE-2015-5785. CWE: CWE-119. CVSS: 6.800000190734863. Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.
Near-miss passage: CVE-2015-1706. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718.
Query: Suspicious Right-to-Left Override execution detected on endpoint
Matching passage: T1036.002 Right-to-Left Override. Tactics: stealth. Description: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named <code>March 25 \u202Excod.scr</code> will display as <code>March 25 rcs.docx</code>. A JavaScript file named <code>photo_high_re\u202Egnp.js</code> will be displayed as <code>photo_high_resj.png</code>.(Citation: Infosecinstitute RTLO Technique) Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Near-miss passage: T1036.001 Invalid Code Signature. Tactics: stealth. Description: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dog. Logsource: windows / file_event. Rule: title: File Creation In Suspicious Directory By Msdt.EXE id: 318557a5-150c-4c8d-b70e-a9910e199857 status: test description: Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities references: - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/ author: Vadim Varganov, Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2023-02-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 - cve.2022-30190 logsource: category: file_event product: windows detection: selection: Image|endswith: \msdt.exe TargetFilename|contains: - \Desktop\ - \Start Menu\Programs\Startup\ - C:\PerfLogs\ - C:\ProgramData\ - C:\Users\Public\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious application installed by looking at the added shortcut to the app resolver cache. Logsource: windows / shell-core. Rule: title: Suspicious Application Installed id: 83c161b6-ca67-4f33-8ad0-644a0737cf07 status: test description: Detects suspicious application installed by looking at the added shortcut to the app resolver cache references: - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: shell-core detection: selection_name: EventID: 28115 Name|contains: - Zenmap - AnyDesk - wireshark - openvpn selection_packageid: EventID: 28115 AppID|contains: - zenmap.exe - prokzult ad - wireshark - openvpn condition: 1 of selection_* falsepositives: - Packages or applications being legitimately used by users or administrators level: medium
Query: write Sigma for User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the accoun
Matching passage: Sigma rule: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the accoun. Logsource: azure / signinlogs. Rule: title: Multifactor Authentication Denied id: e40f4962-b02b-4192-9bfe-245f7ece1f99 status: test description: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account. references: - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ author: AlertIQ date: 2022-03-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 - attack.t1621 logsource: product: azure service: signinlogs detection: selection: AuthenticationRequirement: multiFactorAuthentication Status|contains: MFA Denied condition: selection falsepositives: - Users actually login but miss-click into the Deny button when MFA prompt. level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64). Logsource: windows / process_creation. Rule: title: UAC Bypass Using IEInstal - Process id: 80fc36aa-945e-4181-89f2-2f907ab6775d status: test description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \ieinstal.exe Image|contains: \AppData\Local\Temp\ Image|endswith: consent.exe condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-1495
Matching passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Near-miss passage: CVE-2015-3713. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted movie file.
Query: risk of AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Matching passage: CVE-2015-3678. CWE: CWE-77. CVSS: 7.199999809265137. AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Near-miss passage: CVE-2015-6613. CWE: CWE-77. CVSS: 5.099999904632568. Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.
Query: patch priority for CVE-2015-0046
Matching passage: CVE-2015-0046. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0042.
Near-miss passage: CVE-2015-6295. CWE: CWE-399. CVSS: 4.800000190734863. Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560.
Query: exploit The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers sect
Matching passage: CVE-2015-1779. CWE: CWE-400. CVSS: 8.600000381469727. The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.
Near-miss passage: CVE-2015-5695. CWE: CWE-400. CVSS: 6.5. Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.
Query: Sigma rule for Detects a code page switch in command line or batch scripts to a rare language
Matching passage: Sigma rule: Detects a code page switch in command line or batch scripts to a rare language. Logsource: windows / process_creation. Rule: title: Suspicious CodePage Switch Via CHCP id: c7942406-33dd-4377-a564-0f62db0593a3 status: test description: Detects a code page switch in command line or batch scripts to a rare language references: - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers - https://twitter.com/cglyer/status/1183756892952248325 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2019-10-14 modified: 2023-03-07 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|endswith: \chcp.com CommandLine|endswith: - ' 936' - ' 1258' condition: selection falsepositives: - Administrative activity (adjust code pages according to your organization's region) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml
Near-miss passage: Sigma rule: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistenc. Logsource: windows / registry_set. Rule: title: Potential Persistence Via DLLPathOverride id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8 status: test description: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process references: - https://persistence-info.github.io/Data/naturallanguage6.html - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_root: TargetObject|contains: \SYSTEM\CurrentControlSet\Control\ContentIndex\Language\ selection_values: TargetObject|contains: - \StemmerDLLPathOverride - \WBDLLPathOverride - \StemmerClass - \WBreakerClass condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit atmfd.dll in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and 
Matching passage: CVE-2015-2506. CWE: CWE-20. CVSS: 9.300000190734863. atmfd.dll in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to cause a denial of service (system crash) via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
Near-miss passage: CVE-2015-1043. CWE: CWE-20. CVSS: 3.299999952316284. The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.
Query: incident response steps for Suspicious Dead Drop Resolver execution detected on endpoint
Matching passage: Playbook for T1102.001 Dead Drop Resolver. 1) Validate alert telemetry against T1102.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and s
Near-miss passage: Playbook for T1102 Web Service. Different response path focused on command and control.