alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Security Support Provider
Matching passage: T1547.005 Security Support Provider. Tactics: persistence, privilege escalation. Description: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
Near-miss passage: T1547.003 Time Providers. Tactics: persistence, privilege escalation. Description: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider) Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider) Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)
Query: common weakness: Improper Authorization in Handler for Custom URL Scheme
Matching passage: CWE-939 Improper Authorization in Handler for Custom URL Scheme. The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
Near-miss passage: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Query: rule covering Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.
Matching passage: Sigma rule: Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.. Logsource: windows / registry_set. Rule: title: Change Winevt Channel Access Permission Via Registry id: 7d9263bd-dc47-4a58-bc92-5474abab390c status: test description: Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel. references: - https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/ - https://learn.microsoft.com/en-us/windows/win32/api/winevt/ - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: frack113 date: 2022-09-17 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \ChannelAccess Details|contains: - (A;;0x1;;;LA) - (A;;0x1;;;SY) - (A;;0x5;;;BA) filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg. Logsource: zeek / dns. Rule: title: New Kind of Network (NKN) Detection id: fa7703d6-0ee8-4949-889c-48c84bc15b6f status: test description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma> references: - https://github.com/nknorg/nkn-sdk-go - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - https://github.com/Maka8ka/NGLite author: Michael Portera (@mportatoes) date: 2022-04-21 tags: - attack.command-and-control logsource: product: zeek service: dns detection: selection: query|contains|all: - seed - .nkn.org condition: selection falsepositives: - Unknown level: low
Query: patch priority for CVE-2015-1340
Matching passage: CVE-2015-1340. CWE: CWE-362. CVSS: 8.100000381469727. LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Near-miss passage: CVE-2015-4170. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.
Query: vulnerability: Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted pathname.
Matching passage: CVE-2015-7037. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted pathname.
Near-miss passage: CVE-2015-8799. CWE: CWE-22. CVSS: 7.599999904632568. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.
Query: CVE similar to CVE-2015-1781
Matching passage: CVE-2015-1781. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.
Near-miss passage: CVE-2015-7860. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.
Query: patch priority for CVE-2015-8397
Matching passage: CVE-2015-8397. CWE: CWE-125. CVSS: 8.199999809265137. The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-7506. CWE: CWE-125. CVSS: 6.5. The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted LZW stream in a GIF file.
Query: telemetry for T1218.015
Matching passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
Near-miss passage: T1218.007 Msiexec. Tactics: stealth. Description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the <code>AlwaysInstallElevated</code> policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)
Query: detect Detects suspicious ways to run Invoke-Execution using IEX alias in logs
Matching passage: Sigma rule: Detects suspicious ways to run Invoke-Execution using IEX alias. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell IEX Execution Patterns id: 09576804-7a05-458e-a817-eb718ca91f54 status: test description: Detects suspicious ways to run Invoke-Execution using IEX alias references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2 - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-03-24 modified: 2022-11-28 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_combined_1: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' | iex;' - ' | iex ' - ' | iex}' - ' | IEX ;' - ' | IEX -Error' - ' | IEX (new' - ');IEX ' selection_combined_2: CommandLine|contains: - ::FromBase64String - '.GetString([System.Convert]::' selection_standalone: CommandLine|contains: - )|iex;$ - );iex($ - );iex $ - ' | IEX | ' - ' | iex\"' condition: all of selection_combined_* or selection_standalone falsepositives: - Legitimate scripts that use IEX level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - new-object - text.encoding]::ascii ScriptBlockText|contains: - system.io.compression.deflatestream - system.io.streamreader ScriptBlockText|endswith: readtoend condition: selection_4104 falsepositives: - Unknown level: medium
Query: describe CVE-2015-4231
Matching passage: CVE-2015-4231. CWE: CWE-264. CVSS: 3.5999999046325684. The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.
Near-miss passage: CVE-2015-4221. CWE: CWE-264. CVSS: 4.0. Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecified web page and then conducting a decryption attack, aka Bug ID CSCuq46194.
Query: describe CVE-2015-8723
Matching passage: CVE-2015-8723. CWE: CWE-20. CVSS: 5.5. The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Near-miss passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.
Query: CWE for Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Matching passage: CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
Near-miss passage: CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
Query: vulnerability: FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF
Matching passage: CVE-2015-2754. CWE: CWE-20. CVSS: 6.800000190734863. FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."
Near-miss passage: CVE-2015-7557. CWE: CWE-20. CVSS: 7.5. The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation b. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via Reversed Commands id: b6b49cd1-34d6-4ead-b1bf-176e9edba9a4 status: test description: Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers references: - https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/ - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-05-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: - hctac - kaerb - dnammoc - ekovn - eliFd - rahc - etirw - golon - tninon - eddih - tpircS - ssecorp - llehsrewop - esnopser - daolnwod - tneilCbeW - tneilc - ptth - elifotevas - 46esab - htaPpmeTteG - tcejbO - maerts - hcaerof - retupmoc filter_main_encoded_keyword: CommandLine|contains: - ' -EncodedCommand ' - ' -enc ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages. Logsource: windows / ps_script. Rule: title: Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript id: 975b2262-9a49-439d-92a6-0709cccdf0b2 related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af type: similar status: test description: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages references: - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package - https://twitter.com/WindowsDocs/status/1620078135080325122 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-31 tags: - attack.persistence - attack.stealth logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection_cmdlet: ScriptBlockText|contains: - 'Add-AppPackage ' - 'Add-AppxPackage ' selection_flag: ScriptBlockText|contains: ' -AllowUnsigned' condition: all of selection_* falsepositives: - Installation of unsigned packages for testing purposes level: medium
Query: detection rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0
Matching passage: Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / security. Rule: title: Service Installed By Unusual Client - Security id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca related: - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html - https://www.x86matthew.com/view_post?id=create_svc_rpc - https://twitter.com/SBousseaden/status/1490608838701166596 author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: service: security product: windows definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection_eid: EventID: 4697 selection_pid: - ClientProcessId: 0 - ParentProcessId: 0 condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling. Logsource: azure / auditlogs. Rule: title: Application URI Configuration Changes id: 0055ad1f-be85-4798-83cf-a6da17c993b3 status: test description: 'Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.stealth - attack.t1528 - attack.t1078.004 - attack.persistence - attack.credential-access - attack.privilege-escalation logsource: product: azure service: auditlogs detection: selection: properties.message: Update Application Sucess- Property Name AppAddress condition: selection falsepositives: - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event. level: high
Query: detection rule: Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a
Matching passage: Sigma rule: Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a. Logsource: windows / process_creation. Rule: title: File And SubFolder Enumeration Via Dir Command id: 7c9340a9-e2ee-4e43-94c5-c54ebbea1006 status: test description: 'Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113 date: 2021-12-13 modified: 2026-05-18 tags: - attack.discovery - attack.t1217 logsource: category: process_creation product: windows detection: selection_cmd: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|windash: -s CommandLine|contains: 'dir ' filter_main_rmdir: CommandLine|contains: rmdir condition: all of selection_* and not 1 of filter_main_* falsepositives: - Likely level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_dir_execution/info.yml simulation: - type: atomic-red-team name: List Internet Explorer Bookmarks using the command prompt technique: T1217 atomic_guid: 727dbcdb-e495-4ab1-a6c4-80c7f77aef85
Near-miss passage: Sigma rule: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64". Logsource: windows / ps_script. Rule: title: Powershell Install a DLL in System Directory id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd status: test description: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64" references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-27 modified: 2024-01-22 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|re: (Copy-Item|cpi) .{2,128} -Destination .{1,32}\\Windows\\(System32|SysWOW64) condition: selection falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability 
Matching passage: CVE-2015-7420. CWE: CWE-200. CVSS: 3.700000047683716. Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2015-7421.
Near-miss passage: CVE-2015-3030. CWE: CWE-200. CVSS: 4.0. The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors.