alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: actor TTPs: Launchctl
Matching passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Query: CVE similar to CVE-2015-6914
Matching passage: CVE-2015-6914. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Near-miss passage: CVE-2015-2060. CWE: CWE-22. CVSS: 5.300000190734863. cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.
Query: risk of Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-1566. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5481. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
Query: detection rule: Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unau
Matching passage: Sigma rule: Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Execution GCC - Linux id: 9b5de532-a757-4d70-946c-1f3e44f48b4d status: test description: 'Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/gcc/#shell - https://gtfobins.github.io/gtfobins/c89/#shell - https://gtfobins.github.io/gtfobins/c99/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /c89 - /c99 - /gcc CommandLine|contains: -wrapper selection_cli: CommandLine|contains: - /bin/bash,-s - /bin/dash,-s - /bin/fish,-s - /bin/sh,-s - /bin/zsh,-s condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both cre. Logsource: windows / process_creation. Rule: title: PUA - Mouse Lock Execution id: c9192ad9-75e5-43eb-8647-82a0a5b493e3 status: test description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents. references: - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf - https://sourceforge.net/projects/mouselock/ author: Cian Heasley date: 2020-08-13 modified: 2023-02-21 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: product: windows category: process_creation detection: selection: - Product|contains: Mouse Lock - Company|contains: Misc314 - CommandLine|contains: Mouse Lock_ condition: selection falsepositives: - Legitimate uses of Mouse Lock software level: medium
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Parent Process id: 4e7050dd-e548-483f-b7d6-527ab4fa784d related: - id: 11b1ed55-154d-4e82-8ad7-83739298f720 type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data' detection: selection_file: TargetFilename|endswith: \ntds.dit selection_process_parent: ParentImage|endswith: - \cscript.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \powershell.exe - \pwsh.exe - \w3wp.exe - \wscript.exe selection_process_parent_path: ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_file and 1 of selection_process_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detection of unusual child processes by different system processes. Logsource: windows / process_creation. Rule: title: Abused Debug Privilege by Arbitrary Parent Processes id: d522eca2-2973-4391-a3e0-ef0374321dae status: test description: Detection of unusual child processes by different system processes references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg author: Semanur Guneysu @semanurtg, oscd.community date: 2020-10-28 modified: 2022-11-11 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \winlogon.exe - \services.exe - \lsass.exe - \csrss.exe - \smss.exe - \wininit.exe - \spoolsv.exe - \searchindexer.exe User|contains: - AUTHORI - AUTORI selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Cmd.Exe filter: CommandLine|contains|all: - ' route ' - ' ADD ' condition: all of selection_* and not filter falsepositives: - Unknown level: high
Query: Sigma rule for Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin
Matching passage: Sigma rule: Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mappin. Logsource: windows / system. Rule: title: Certificate Use With No Strong Mapping id: 993c2665-e6ef-40e3-a62a-e1a97686af79 status: test description: 'Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing. ' references: - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 author: '@br4dy5' date: 2023-10-09 modified: 2025-09-22 tags: - attack.privilege-escalation logsource: product: windows service: system detection: selection: Provider_Name: - Kerberos-Key-Distribution-Center - Microsoft-Windows-Kerberos-Key-Distribution-Center EventID: - 39 - 41 condition: selection falsepositives: - If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user - If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name level: medium
Near-miss passage: Sigma rule: Attackers may leverage fsutil to enumerated connected drives.. Logsource: windows / process_creation. Rule: title: Fsutil Drive Enumeration id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6 status: test description: Attackers may leverage fsutil to enumerated connected drives. references: - Turla has used fsutil fsinfo drives to list connected drives. - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2022-03-29 modified: 2022-07-14 tags: - attack.discovery - attack.t1120 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: drives condition: all of selection_* falsepositives: - Certain software or administrative tasks may trigger false positives. level: low
Query: detect Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30) in logs
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30). Logsource: windows / process_access. Rule: title: UAC Bypass Using WOW64 Logger DLL Hijack id: 4f6c43e2-f989-4ea5-bcd8-843b49a0317c status: test description: Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_access product: windows detection: selection: SourceImage|contains: :\Windows\SysWOW64\ GrantedAccess: '0x1fffff' CallTrace|startswith: UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)| condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a Python process initiating a network connection. While this often relates to package installation, it can also. Logsource: windows / network_connection. Rule: title: Python Initiated Connection id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6 status: test description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python - https://pypi.org/project/scapy/ author: frack113 date: 2021-12-10 modified: 2025-03-05 tags: - attack.discovery - attack.t1046 logsource: category: network_connection product: windows definition: 'Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type' detection: selection: Initiated: 'true' Image|contains|all: - \python - .exe filter_optional_conda: ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe CommandLine|contains|all: - :\ProgramData\Anaconda3\Scripts\conda-script.py - update filter_optional_conda_jupyter_notebook: ParentImage: C:\ProgramData\Anaconda3\python.exe CommandLine|contains: C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py filter_main_local_communication: DestinationIp: 127.0.0.1 SourceIp: 127.0.0.1 filter_main_pip: CommandLine|contains|all: - pip.exe - install condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying. level: medium
Query: risk of Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, and Ex
Matching passage: CVE-2015-6038. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3, 2010 SP2, and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Query: detection rule: Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection an
Matching passage: Sigma rule: Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection an. Logsource: windows / process_creation. Rule: title: LSA PPL Protection Setting Modification via CommandLine id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9 status: test description: 'Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory. ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-03-22 modified: 2026-03-13 tags: - attack.defense-impairment - attack.t1689 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - powershell.exe - pwsh.dll selection_cli_action: CommandLine|contains|all: - ControlSet - \Control\Lsa CommandLine|contains: - Set-ItemProperty - New-ItemProperty - ' add ' selection_key: CommandLine|contains: - IsPplAutoEnabled - RunAsPPL - RunAsPPLBoot condition: all of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions). Logsource: windows / process_creation. Rule: title: Suspicious SysAidServer Child id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6 status: test description: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions) references: - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/ author: Florian Roth (Nextron Systems) date: 2022-08-26 tags: - attack.lateral-movement - attack.t1210 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: SysAidServer condition: selection falsepositives: - Unknown level: medium
Query: write Sigma for Find local accounts being created or modified as well as remote authentication configurations
Matching passage: Sigma rule: Find local accounts being created or modified as well as remote authentication configurations. Logsource: cisco / aaa. Rule: title: Cisco Local Accounts id: 6d844f0f-1c18-41af-8f19-33e7654edfc3 status: test description: Find local accounts being created or modified as well as remote authentication configurations author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: cisco service: aaa detection: keywords: - username - aaa condition: keywords falsepositives: - When remote authentication is in place, this should not change often level: high
Near-miss passage: Sigma rule: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via Window. Logsource: windows / process_creation. Rule: title: Suspicious WindowsTerminal Child Processes id: 8de89e52-f6e1-4b5b-afd1-41ecfa300d48 status: test description: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section) references: - https://persistence-info.github.io/Data/windowsterminalprofile.html - https://twitter.com/nas_bench/status/1550836225652686848 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-25 modified: 2023-02-14 tags: - attack.execution - attack.persistence logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WindowsTerminal.exe - \wt.exe selection_susp: - Image|endswith: - \rundll32.exe - \regsvr32.exe - \certutil.exe - \cscript.exe - \wscript.exe - \csc.exe - Image|contains: - C:\Users\Public\ - \Downloads\ - \Desktop\ - \AppData\Local\Temp\ - \Windows\TEMP\ - CommandLine|contains: - ' iex ' - ' icm' - Invoke- - 'Import-Module ' - 'ipmo ' - DownloadString( - ' /c ' - ' /k ' - ' /r ' filter_builtin_visual_studio_shell: CommandLine|contains|all: - Import-Module - Microsoft.VisualStudio.DevShell.dll - Enter-VsDevShell filter_open_settings: CommandLine|contains|all: - \AppData\Local\Packages\Microsoft.WindowsTerminal_ - \LocalState\settings.json filter_vsdevcmd: CommandLine|contains|all: - C:\Program Files\Microsoft Visual Studio\ - \Common7\Tools\VsDevCmd.bat condition: all of selection_* and not 1 of filter_* falsepositives: - Other legitimate "Windows Terminal" profiles level: medium
Query: vulnerability: Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrar
Matching passage: CVE-2015-4670. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.
Near-miss passage: CVE-2015-9266. CWE: CWE-22. CVSS: 9.800000190734863. The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
Query: CVE similar to CVE-2015-7801
Matching passage: CVE-2015-7801. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
Near-miss passage: CVE-2015-1249. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: risk of D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when runn
Matching passage: CVE-2015-7247. CWE: CWE-200. CVSS: 9.800000190734863. D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.
Near-miss passage: CVE-2015-3171. CWE: CWE-200. CVSS: 5.5. sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Query: CWE for Improper Handling of Apple HFS+ Alternate Data Stream Path
Matching passage: CWE-72 Improper Handling of Apple HFS+ Alternate Data Stream Path. The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.
Near-miss passage: CWE-791 Incomplete Filtering of Special Elements. The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.