alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication in logs
Matching passage: Sigma rule: Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication. Logsource: webserver. Rule: title: Suspicious Windows Strings In URI id: 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e status: test description: Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-01-02 tags: - attack.persistence - attack.exfiltration - attack.t1505.003 logsource: category: webserver detection: selection: cs-uri-query|contains: - =C:/Users - =C:/Program%20Files - =C:/Windows - =C%3A%5CUsers - =C%3A%5CProgram%20Files - =C%3A%5CWindows condition: selection falsepositives: - Legitimate application and websites that use windows paths in their URL level: high
Near-miss passage: Sigma rule: Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as see. Logsource: macos / process_creation. Rule: title: JAMF MDM Potential Suspicious Child Process id: 2316929c-01aa-438c-970f-099145ab1ee6 status: test description: Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent. references: - https://github.com/MythicAgents/typhon/ - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-22 tags: - attack.execution logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /jamf Image|endswith: - /bash - /sh condition: selection falsepositives: - Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly level: medium
Query: common weakness: Improper Following of Specification by Caller
Matching passage: CWE-573 Improper Following of Specification by Caller. The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
Near-miss passage: CWE-488 Exposure of Data Element to Wrong Session. The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
Query: exploit SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbit
Matching passage: CVE-2015-0161. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1476. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php.
Query: rule covering Detects the download of a file with a potentially suspicious extension from a .zip top level domain.
Matching passage: Sigma rule: Detects the download of a file with a potentially suspicious extension from a .zip top level domain.. Logsource: windows / create_stream_hash. Rule: title: Potentially Suspicious File Download From ZIP TLD id: 0bb4bbeb-fe52-4044-b40c-430a04577ebe status: test description: Detects the download of a file with a potentially suspicious extension from a .zip top level domain. references: - https://twitter.com/cyb3rops/status/1659175181695287297 - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/ author: Florian Roth (Nextron Systems) date: 2023-05-18 tags: - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|contains: .zip/ TargetFilename|contains: - .bat:Zone - .dat:Zone - .dll:Zone - .doc:Zone - .docm:Zone - .exe:Zone - .hta:Zone - .pptm:Zone - .ps1:Zone - .rar:Zone - .rtf:Zone - .sct:Zone - .vbe:Zone - .vbs:Zone - .ws:Zone - .wsf:Zone - .xll:Zone - .xls:Zone - .xlsm:Zone - .zip:Zone condition: selection falsepositives: - Legitimate file downloads from a websites and web services that uses the ".zip" top level domain. level: high
Near-miss passage: Sigma rule: Detects Octopus Scanner Malware.. Logsource: windows / file_event. Rule: title: Octopus Scanner Malware id: 805c55d9-31e6-4846-9878-c34c75054fe9 status: test description: Detects Octopus Scanner Malware. references: - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain author: NVISO date: 2020-06-09 modified: 2021-11-27 tags: - attack.initial-access - attack.t1195 - attack.t1195.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \AppData\Local\Microsoft\Cache134.dat - \AppData\Local\Microsoft\ExplorerSync.db condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-3743
Matching passage: CVE-2015-3743. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-1898. CWE: CWE-119. CVSS: 7.199999809265137. Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1897.
Query: vulnerability: Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest use
Matching passage: CVE-2015-2152. CWE: CWE-264. CVSS: 1.899999976158142. Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Near-miss passage: CVE-2015-1688. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: vulnerability: IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-3776. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Near-miss passage: CVE-2015-1500. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via unspecified vectors to (1) graphManager.load or (2) factory.load.
Query: patch priority for CVE-2015-6416
Matching passage: CVE-2015-6416. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479.
Near-miss passage: CVE-2015-9453. CWE: CWE-79. CVSS: 6.099999904632568. The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Query: vulnerability: A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runti
Matching passage: CVE-2015-1834. CWE: CWE-22. CVSS: 6.5. A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
Near-miss passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Query: write Sigma for Windows Defender logs when the history of detected infections is deleted.
Matching passage: Sigma rule: Windows Defender logs when the history of detected infections is deleted.. Logsource: windows / windefend. Rule: title: Windows Defender Malware Detection History Deletion id: 2afe6582-e149-11ea-87d0-0242ac130003 status: test description: Windows Defender logs when the history of detected infections is deleted. references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus - https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e author: Cian Heasley date: 2020-08-13 modified: 2023-11-24 tags: - attack.defense-impairment logsource: product: windows service: windefend detection: selection: EventID: 1013 condition: selection falsepositives: - Deletion of Defender malware detections history for legitimate reasons level: informational
Near-miss passage: Sigma rule: Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functio. Logsource: windows / process_creation. Rule: title: XSL Script Execution Via WMIC.EXE id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d related: - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 type: similar - id: 8d63dadf-b91b-4187-87b6-34a1114577ea type: similar status: test description: 'Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel date: 2019-10-21 modified: 2026-01-24 tags: - attack.stealth - attack.t1047 - attack.t1220 - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe - Hashes|contains: - IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E - IMPHASH=37777A96245A3C74EB217308F3546F4C - IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 - IMPHASH=B12619881D79C3ACADF45E752A58554A - IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 selection_cmd: CommandLine|contains|windash: '-format:' filter_main_known_format: CommandLine|contains: - Format:List - Format:htable - Format:hform - Format:table - Format:mof - Format:value - Format:rawxml - Format:xml - Format:csv filter_main_remote_operation: CommandLine|contains: - :// - \\\\ condition: all of selection_* and not 1 of filter_main_* falsepositives: - WMIC.exe FP depend on scripts and administrative methods used in the monitored environment. - Static format arguments - https://petri.com/command-line-wmi-part-3 level: medium
Query: exploit Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote ad
Matching passage: CVE-2015-3301. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Near-miss passage: CVE-2015-5313. CWE: CWE-22. CVSS: 2.5. Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.
Query: write Sigma for Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca
Matching passage: Sigma rule: Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca. Logsource: windows / security. Rule: title: Potential Privilege Escalation via Local Kerberos Relay over LDAP id: 749c9f5e-b353-4b90-a9c1-05243357ca4b status: test description: 'Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges. ' references: - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38 author: Elastic, @SBousseaden date: 2022-04-27 modified: 2024-08-13 tags: - attack.privilege-escalation - attack.credential-access - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 AuthenticationPackageName: Kerberos IpAddress: 127.0.0.1 TargetUserSid|startswith: S-1-5-21- TargetUserSid|endswith: '-500' filter_main_ip_null: IpPort: '0' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe. Logsource: windows / process_creation. Rule: title: HackTool - Impersonate Execution id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 status: test description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ - https://github.com/sensepost/impersonate author: Sai Prashanth Pulisetti @pulisettis date: 2022-12-21 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_commandline_exe: CommandLine|contains: impersonate.exe selection_commandline_opt: CommandLine|contains: - ' list ' - ' exec ' - ' adduser ' selection_hash: Hashes|contains: - MD5=9520714AB576B0ED01D1513691377D01 - SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A - IMPHASH=0A358FFC1697B7A07D0E817AC740DF62 condition: all of selection_commandline_* or selection_hash falsepositives: - Unknown level: medium
Query: common weakness: Regular Expression without Anchors
Matching passage: CWE-777 Regular Expression without Anchors. The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.
Near-miss passage: CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere. The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
Query: Encoded PowerShell / command-line abuse matching Electron Applications
Matching passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Near-miss passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the bina. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via Windows Telemetry id: 73a883d0-0348-4be4-a8d8-51031c2564f8 related: - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5 type: obsolete status: test description: 'Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type. ' references: - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/ author: Lednyov Alexey, oscd.community, Sreeman date: 2020-10-16 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLM hives' detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\ TargetObject|endswith: \Command Details|contains: - .bat - .bin - .cmd - .dat - .dll - .exe - .hta - .jar - .js - .msi - .ps - .sh - .vb filter_main_generic: Details|contains: - \system32\CompatTelRunner.exe - \system32\DeviceCensus.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data.. Logsource: windows / process_creation. Rule: title: Automated Collection Command Prompt id: f576a613-2392-4067-9d1a-9345fb58d8d1 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: frack113 date: 2021-07-28 modified: 2022-11-11 tags: - attack.collection - attack.t1119 - attack.credential-access - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_ext: CommandLine|contains: - .doc - .docx - .xls - .xlsx - .ppt - .pptx - .rtf - .pdf - .txt selection_other_dir: CommandLine|contains|all: - 'dir ' - ' /b ' - ' /s ' selection_other_findstr: OriginalFileName: FINDSTR.EXE CommandLine|contains: - ' /e ' - ' /si ' condition: selection_ext and 1 of selection_other_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-3253
Matching passage: CVE-2015-3253. CWE: CWE-74. CVSS: 9.800000190734863. The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Near-miss passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.