alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate st
Matching passage: Sigma rule: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate st. Logsource: windows / ps_script. Rule: title: Certificate Exported Via PowerShell - ScriptBlock id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c related: - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb type: similar status: test description: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines. references: - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Florian Roth (Nextron Systems) date: 2021-04-23 modified: 2023-05-18 tags: - attack.credential-access - attack.t1552.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PfxCertificate - Export-Certificate filter_optional_module_export: ScriptBlockText|contains: CmdletsToExport = @( condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate certificate exports by administrators. Additional filters might be required. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module id: a23791fe-8846-485a-b16b-ca691e1b03d4 related: - id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 type: derived status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection_4103 falsepositives: - Unknown level: medium
Query: describe CVE-2015-1365
Matching passage: CVE-2015-1365. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
Near-miss passage: CVE-2015-2971. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Query: risk of Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Micro
Matching passage: CVE-2015-2521. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-9063. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a procedure involving a remote UIM client.
Query: vulnerability: The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet
Matching passage: CVE-2015-4700. CWE: CWE-17. CVSS: 4.900000095367432. The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
Near-miss passage: CVE-2015-5605. CWE: CWE-17. CVSS: 5.0. The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.
Query: write Sigma for Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr
Matching passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Near-miss passage: Sigma rule: Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val. Logsource: windows / process_creation. Rule: title: New Remote Desktop Connection Initiated Via Mstsc.EXE id: 954f0af7-62dd-418f-b3df-a84bc2c7a774 status: test description: 'Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc author: frack113 date: 2022-01-07 modified: 2024-06-04 tags: - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|contains|windash: ' /v:' filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - WSL (Windows Sub System For Linux) level: medium
Query: write Sigma for Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikat
Matching passage: Sigma rule: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikat. Logsource: windows / process_access. Rule: title: Remote LSASS Process Access Through Windows Remote Management id: aa35a627-33fb-4d04-a165-d33b4afca3e8 status: stable description: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz. references: - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ author: Patryk Prauze - ING Tech date: 2019-05-20 modified: 2023-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: :\Windows\system32\wsmprovhost.exe filter_main_access: GrantedAccess: '0x80000000' condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll,. Logsource: zeek / http. Rule: title: HTTP Request to Low Reputation TLD or Suspicious File Extension id: 68c2c604-92ad-468b-bf4a-aac49adad08c status: experimental description: 'Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity. ' references: - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows - https://www.spamhaus.org/reputation-statistics/cctlds/domains/ author: '@signalblur, Corelight' date: 2025-02-26 tags: - attack.initial-access - attack.command-and-control logsource: product: zeek service: http detection: selection_suspicious_tld: host|endswith: - .bid - .by - .cf - .click - .cm - .ga - .gq - .ir - .kp - .loan - .ml - .mm - .party - .pw - .ru - .su - .sy - .tk - .top - .tv - .ve - .work - .xyz selection_malicious_ext: uri|endswith: - .bat - .bin - .cmd - .cpl - .dll - .dylib - .elf - .exe - .hta - .iso - .jar - .js - .lnk - .msi - .pif - .ps1 - .py - .reg - .scr - .sh - .so - .vbs - .wsf selection_malicious_mime: resp_mime_types: - application/vnd.microsoft.portable-executable - application/x-bat - application/x-dosexec - application/x-elf - application/x-iso9660-image - application/x-java-archive - application/x-ms-shortcut - application/x-msdos-program - application/x-msdownload - application/x-python-code - application/x-sh condition: selection_suspicious_tld and 1 of selection_malicious_* falsepositives: - Rare legitimate software downloads from low quality TLDs level: medium
Query: detect Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. in logs
Matching passage: Sigma rule: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.. Logsource: windows / process_creation. Rule: title: DLL Loaded via CertOC.EXE id: 242301bc-f92f-4476-8718-78004a6efd9f related: - id: 84232095-ecca-4015-b0d7-7726507ee793 type: similar status: test description: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. references: - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20 - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2 - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Austin Songer @austinsonger date: 2021-10-23 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|windash: ' -LoadDLL ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connect. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Cmstp.EXE id: efafe0bf-4238-479e-af8f-797bd3490d2d status: test description: 'Detects a network connection initiated by Cmstp.EXE Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious. ' references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-30 modified: 2024-05-31 tags: - attack.stealth - attack.t1218.003 logsource: category: network_connection product: windows detection: selection: Image|endswith: \cmstp.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: actor TTPs: Domains
Matching passage: T1583.001 Domains. Tactics: resource development. Description: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique) Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such pr
Near-miss passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Query: detect Detects the presence of a loaded unsigned kernel module on the system. in logs
Matching passage: Sigma rule: Detects the presence of a loaded unsigned kernel module on the system.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unsigned Kernel Module Loaded id: 951f8d29-f2f6-48a7-859f-0673ff105e6f status: test description: Detects the presence of a loaded unsigned kernel module on the system. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hos. Logsource: windows / network_connection. Rule: title: Local Network Connection Initiated By Script Interpreter id: 08249dc0-a28d-4555-8ba5-9255a198e08c related: - id: 992a6cae-db6a-43c8-9cec-76d7195c96fc type: derived status: test description: 'Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md author: frack113 date: 2022-08-28 modified: 2024-05-31 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \wscript.exe - \cscript.exe DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection falsepositives: - Legitimate scripts level: medium
Query: write Sigma for Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other
Matching passage: Sigma rule: Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other. Logsource: windows / file_delete. Rule: title: Unusual File Deletion by Dns.exe id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0 related: - id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3 type: similar status: test description: Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-27 modified: 2023-02-15 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: file_delete product: windows detection: selection: Image|endswith: \dns.exe filter: TargetFilename|endswith: \dns.log condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On MacOS Host id: f459ccb4-9805-41ea-b5b2-55e279e2424a related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Query: write Sigma for Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.
Matching passage: Sigma rule: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Silent Installation id: 114e7f1c-f137-48c8-8f54-3088c24ce4b9 status: test description: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access. references: - https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20 - https://support.anydesk.com/Automatic_Deployment author: Ján Trenčanský date: 2021-08-06 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --install - --start-with-win - --silent condition: selection falsepositives: - Legitimate deployment of AnyDesk level: high
Near-miss passage: Sigma rule: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that ma. Logsource: windows / ps_script. Rule: title: Suspicious Mount-DiskImage id: 29e1c216-6408-489d-8a06-ee9d151ef819 status: test description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Mount-DiskImage ' - '-ImagePath ' condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Query: patch priority for CVE-2015-3369
Matching passage: CVE-2015-3369. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block.
Near-miss passage: CVE-2015-0766. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196.
Query: vulnerability: Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified 
Matching passage: CVE-2015-2061. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.
Near-miss passage: CVE-2015-4931. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4932, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.