alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects files dropped by Winnti as described in RedMimicry Winnti playbook. Logsource: windows / file_event. Rule: title: Potential Winnti Dropper Activity id: 130c9e58-28ac-4f83-8574-0a4cc913b97e status: test description: Detects files dropped by Winnti as described in RedMimicry Winnti playbook references: - https://redmimicry.com/posts/redmimicry-winnti/#dropper author: Alexander Rausch date: 2020-06-24 modified: 2023-01-05 tags: - attack.stealth - attack.t1027 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \gthread-3.6.dll - \sigcmm-2.4.dll - \Windows\Temp\tmp.bat condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic. Logsource: windows / process_creation. Rule: title: Potential Windows Defender Tampering Via Wmic.EXE id: 51cbac1e-eee3-4a90-b1b7-358efb81fa0a status: test description: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/ author: frack113 date: 2022-12-11 modified: 2023-02-14 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains: /Namespace:\\\\root\\Microsoft\\Windows\\Defender condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: WMIC Tamper with Windows Defender Evade Scanning Folder technique: T1562.001 atomic_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender/info.yml
Query: rule covering Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more
Matching passage: Sigma rule: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened (Suspicious Filenames) id: 54f0434b-726f-48a1-b2aa-067df14516e4 status: test description: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.command-and-control - attack.stealth - attack.t1027 - attack.t1105 - attack.t1036 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename selection_filename: TargetName|contains: - invoice - new order - rechnung - factura - delivery - purchase - order - payment condition: selection and selection_filename falsepositives: - Legitimate used of encrypted ZIP files level: high
Near-miss passage: Sigma rule: Detects registry changes to Office trust records where the path is located in a potentially suspicious location. Logsource: windows / registry_set. Rule: title: Macro Enabled In A Potentially Suspicious Document id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd related: - id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 type: derived status: test description: Detects registry changes to Office trust records where the path is located in a potentially suspicious location references: - https://twitter.com/inversecos/status/1494174785621819397 - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-21 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_value: TargetObject|contains: \Security\Trusted Documents\TrustRecords selection_paths: TargetObject|contains: - /AppData/Local/Microsoft/Windows/INetCache/ - /AppData/Local/Temp/ - /PerfLogs/ - C:/Users/Public/ - file:///D:/ - file:///E:/ condition: all of selection_* falsepositives: - Unlikely level: high
Query: exploit The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.
Matching passage: CVE-2015-0840. CWE: CWE-284. CVSS: 4.300000190734863. The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
Near-miss passage: CVE-2015-9291. CWE: CWE-284. CVSS: 7.5. cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
Query: CVE similar to CVE-2015-5776
Matching passage: CVE-2015-5776. CWE: CWE-119. CVSS: 7.5. Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
Near-miss passage: CVE-2015-7987. CWE: CWE-119. CVSS: 9.800000190734863. Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1) GetValueForIPv4Addr, (2) GetValueForMACAddr, (3) rfc3110_import, or (4) CopyNSEC3ResourceRecord function.
Query: risk of iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9376. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-9371. CWE: CWE-79. CVSS: 6.099999904632568. Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: credential access using DCSync
Matching passage: T1003.006 DCSync. Tactics: credential access. Description: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
Near-miss passage: T1003.004 LSA Secrets. Tactics: credential access. Description: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
Query: Sigma rule for Detects keywords from well-known PowerShell exploitation frameworks
Matching passage: Sigma rule: Detects keywords from well-known PowerShell exploitation frameworks. Logsource: windows / ps_script. Rule: title: Malicious PowerShell Keywords id: f62176f3-8128-4faa-bf6c-83261322e5eb status: test description: Detects keywords from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-06-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - AdjustTokenPrivileges - IMAGE_NT_OPTIONAL_HDR64_MAGIC - Metasploit - Microsoft.Win32.UnsafeNativeMethods - Mimikatz - MiniDumpWriteDump - PAGE_EXECUTE_READ - ReadProcessMemory.Invoke - SE_PRIVILEGE_ENABLED - SECURITY_DELEGATION - TOKEN_ADJUST_PRIVILEGES - TOKEN_ALL_ACCESS - TOKEN_ASSIGN_PRIMARY - TOKEN_DUPLICATE - TOKEN_ELEVATION - TOKEN_IMPERSONATE - TOKEN_INFORMATION_CLASS - TOKEN_PRIVILEGES - TOKEN_QUERY condition: selection falsepositives: - Depending on the scripts, this rule might require some initial tuning to fit the environment level: medium
Near-miss passage: Sigma rule: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate st. Logsource: windows / ps_script. Rule: title: Certificate Exported Via PowerShell - ScriptBlock id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c related: - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb type: similar status: test description: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines. references: - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Florian Roth (Nextron Systems) date: 2021-04-23 modified: 2023-05-18 tags: - attack.credential-access - attack.t1552.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PfxCertificate - Export-Certificate filter_optional_module_export: ScriptBlockText|contains: CmdletsToExport = @( condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate certificate exports by administrators. Additional filters might be required. level: medium
Query: exploit Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory c
Matching passage: CVE-2015-2380. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1572. CWE: CWE-119. CVSS: 4.599999904632568. Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.
Query: detection engineering for Network Trust Dependencies
Matching passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1590 Gather Victim Network Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: CVE similar to CVE-2015-4329
Matching passage: CVE-2015-4329. CWE: CWE-20. CVSS: 6.5. The administrator web interface in Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796.
Near-miss passage: CVE-2015-5159. CWE: CWE-20. CVSS: 7.5. python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Query: rule covering Detects instances where an SMB service on an OpenCanary node has had a file open request.
Matching passage: Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection packag. Logsource: windows / driver_load. Rule: title: WinDivert Driver Load id: 679085d5-f427-4484-9f58-1dc30a7c426d status: test description: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows references: - https://reqrypt.org/windivert-doc.html - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-07-30 modified: 2024-11-23 tags: - attack.credential-access - attack.collection - attack.defense-impairment - attack.t1599.001 - attack.t1557.001 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|contains: - \WinDivert.sys - \WinDivert64.sys - \NordDivert.sys - \lingtiwfp.sys - \eswfp.sys - Hashes|contains: - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087 - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276 - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76 - IMPHASH=58623490691babe8330adc81cd04a663 - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96 - IMPHASH=a1b2e245acd47e4a348e1a552a02859a - IMPHASH=2a5f85fe4609461c6339637594fa9b0a - IMPHASH=6b2c6f95233c2914d1d488ee27531acc - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342 - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88 - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38 - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6 - IMPHASH=a74929edfc3289895e3f2885278947ae - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4 - IMPHASH=c28cd6ccd83179e79dac132a553693d9 condition: selection falsepositives: - Legitimate WinDivert driver usage level: high
Query: vulnerability: SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vecto
Matching passage: CVE-2015-3783. CWE: CWE-119. CVSS: 7.5. SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Near-miss passage: CVE-2015-2327. CWE: CWE-119. CVSS: 7.5. PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: alert when Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls
Matching passage: Sigma rule: Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls. Logsource: windows / process_creation. Rule: title: Permission Misconfiguration Reconnaissance Via Findstr.EXE id: 47e4bab7-c626-47dc-967b-255608c9a920 status: test description: 'Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions. ' references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-11-11 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: - '"Everyone"' - '''Everyone''' - '"BUILTIN\\"' - '''BUILTIN\''' selection_special: CommandLine|contains|all: - 'icacls ' - 'findstr ' - Everyone condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml
Near-miss passage: Sigma rule: Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen. Logsource: windows / system. Rule: title: Uncommon Service Installation Image Path id: 26481afe-db26-4228-b264-25a29fe6efc7 related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b type: derived status: test description: 'Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc. ' references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2024-02-09 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 suspicious_paths: ImagePath|contains: - \\\\.\\pipe - \Users\Public\ - \Windows\Temp\ suspicious_encoded_flag: ImagePath|contains: ' -e' suspicious_encoded_keywords: ImagePath|contains: - ' aQBlAHgA' - ' aWV4I' - ' IAB' - ' JAB' - ' PAA' - ' SQBFAFgA' - ' SUVYI' filter_optional_thor_remote: ImagePath|startswith: C:\WINDOWS\TEMP\thor10-remote\thor64.exe filter_main_defender_def_updates: ImagePath|startswith: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ condition: selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: exploit The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to ca
Matching passage: CVE-2015-6815. CWE: CWE-835. CVSS: 3.5. The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Near-miss passage: CVE-2015-10103. CWE: CWE-835. CVSS: 5.5. A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.
Query: patch priority for CVE-2015-1308
Matching passage: CVE-2015-1308. CWE: CWE-200. CVSS: 4.300000190734863. kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
Near-miss passage: CVE-2015-3184. CWE: CWE-200. CVSS: 5.0. mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.