alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects a failed installation of a Exchange Transport Agent
Matching passage: Sigma rule: Detects a failed installation of a Exchange Transport Agent. Logsource: windows / msexchange-management. Rule: title: Failed MSExchange Transport Agent Installation id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa status: test description: Detects a failed installation of a Exchange Transport Agent references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8 author: Tobias Michalski (Nextron Systems) date: 2021-06-08 modified: 2022-07-12 tags: - attack.persistence - attack.t1505.002 logsource: service: msexchange-management product: windows detection: selection: EventID: 6 Data|contains: Install-TransportAgent condition: selection falsepositives: - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this. level: high
Near-miss passage: Sigma rule: Detects suspicious addition to BitLocker related registry keys via the reg.exe utility. Logsource: windows / process_creation. Rule: title: Suspicious Reg Add BitLocker id: 0e0255bf-2548-47b8-9582-c0955c9283f5 status: test description: Detects suspicious addition to BitLocker related registry keys via the reg.exe utility references: - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ author: frack113 date: 2021-11-15 modified: 2022-09-09 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - REG - ADD - \SOFTWARE\Policies\Microsoft\FVE - /v - /f CommandLine|contains: - EnableBDEWithNoTPM - UseAdvancedStartup - UseTPM - UseTPMKey - UseTPMKeyPIN - RecoveryKeyMessageSource - UseTPMPIN - RecoveryKeyMessage condition: selection falsepositives: - Unlikely level: high
Query: Sigma rule for Detects when a user disables the Windows Firewall via a Profile to help evade defense.
Matching passage: Sigma rule: Detects when a user disables the Windows Firewall via a Profile to help evade defense.. Logsource: windows / ps_script. Rule: title: Windows Firewall Profile Disabled id: 488b44e7-3781-4a71-888d-c95abfacf44d related: - id: 12f6b752-042d-483e-bf9c-915a6d06ad75 type: similar status: test description: Detects when a user disables the Windows Firewall via a Profile to help evade defense. references: - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell - https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php - http://woshub.com/manage-windows-firewall-powershell/ - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-30 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_args: ScriptBlockText|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: ScriptBlockText|contains: - ' -All ' - Public - Domain - Private condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity m. Logsource: linux / process_creation. Rule: title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04 status: experimental description: 'Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors. ' references: - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm author: Milad Cheraghi date: 2025-10-18 tags: - attack.execution - attack.defense-impairment - attack.t1685 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /systemctl - /bash - /sh CommandLine|contains|all: - stop - kesl condition: selection falsepositives: - System administrator manually stopping Kaspersky services level: high
Query: patch priority for CVE-2015-4305
Matching passage: CVE-2015-4305. CWE: CWE-264. CVSS: 4.0. The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
Near-miss passage: CVE-2015-5849. CWE: CWE-264. CVSS: 6.800000190734863. The filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to send events to a different user, which allows attackers to bypass intended access restrictions by leveraging a screen-sharing connection.
Query: CVE similar to CVE-2015-6586
Matching passage: CVE-2015-6586. CWE: CWE-200. CVSS: 7.5. The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network.
Near-miss passage: CVE-2015-2381. CWE: CWE-200. CVSS: 2.0999999046325684. win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2382.
Query: playbook for alert: Lateral movement indicators for Impersonation
Matching passage: Playbook for T1684.001 Impersonation. 1) Validate alert telemetry against T1684.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or [Internal Spearphishing](https://attack.mitre.org/techniques/T1534
Near-miss passage: Playbook for T1684 Social Engineering. Different response path focused on stealth.
Query: risk of The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio
Matching passage: CVE-2015-9099. CWE: CWE-125. CVSS: 5.5. The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate.
Near-miss passage: CVE-2015-5327. CWE: CWE-125. CVSS: 6.5. Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Query: risk of XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1
Matching passage: CVE-2015-1833. CWE: CWE-20. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Near-miss passage: CVE-2015-2202. CWE: CWE-20. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
Query: Sigma rule for Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abus
Matching passage: Sigma rule: Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abus. Logsource: windows / file_event. Rule: title: Assembly DLL Creation Via AspNetCompiler id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: 'Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution logsource: product: windows category: file_event detection: selection: Image|endswith: \aspnet_compiler.exe TargetFilename|contains|all: - \Temporary ASP.NET Files\ - \assembly\tmp\ - .dll condition: selection falsepositives: - Legitimate assembly compilation using a build provider level: medium
Near-miss passage: Sigma rule: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious. Logsource: windows / image_load. Rule: title: Fax Service DLL Search Order Hijack id: 828af599-4c53-4ed2-ba4a-a9f835c434ea status: test description: The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service. references: - https://windows-internals.com/faxing-your-way-to-system/ author: NVISO date: 2020-05-04 modified: 2022-06-02 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \fxssvc.exe ImageLoaded|endswith: ualapi.dll filter: ImageLoaded|startswith: C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unlikely level: high
Query: explain CWE-643
Matching passage: CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection'). The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
Near-miss passage: CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC). The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.
Query: patch priority for CVE-2015-8627
Matching passage: CVE-2015-8627. CWE: CWE-284. CVSS: 5.300000190734863. MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Near-miss passage: CVE-2015-8838. CWE: CWE-284. CVSS: 5.900000095367432. ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7636. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0384. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector Portal.
Query: detect Hides the file extension through modification of the registry in logs
Matching passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: Registry Modification to Hidden File Extension id: 5df86130-4e95-4a54-90f7-26541b40aec2 status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd - https://unit42.paloaltonetworks.com/ransomware-families/ - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_HideFileExt: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt Details: DWORD (0x00000001) selection_Hidden: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000002) condition: 1 of selection_* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is play. Logsource: azure / riskdetection. Rule: title: Anomalous Token id: 6555754e-5e7f-4a67-ad1c-4041c413a007 status: test description: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow' date: 2023-08-07 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: anomalousToken condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: Suspicious Path Interception by Unquoted Path execution detected on endpoint
Matching passage: T1574.009 Path Interception by Unquoted Path. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch. Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide) This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
Near-miss passage: T1574.014 AppDomainManager. Tactics: stealth, execution. Description: Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains) Known as "AppDomainManager injection," adversaries may execute arbitrary code by hijacking how .NET applications load assemblies. For example, malware may create a custom application domain inside a target process to load and execute an arbitrary assembly. Alternatively, configuration files (`.config`) or process environment variables that define .NET runtime settings may be tampered with to instruct otherwise benign .NET applications to load a malicious assembly (identified by name) into the target process.(Citation: PenTestLabs AppDomainManagerInject)(Citation: PwC Yellow Liderc)(Citation: Rapid7 AppDomain Manager Injection)
Query: CVE similar to CVE-2015-5842
Matching passage: CVE-2015-5842. CWE: CWE-200. CVSS: 2.0999999046325684. XNU in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain sensitive memory-layout information via unknown vectors.
Near-miss passage: CVE-2015-0174. CWE: CWE-200. CVSS: 4.0. The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: write Sigma for Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be
Matching passage: Sigma rule: Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be. Logsource: linux / auditd. Rule: title: Clipboard Collection of Image Data with Xclip Tool id: f200dc3f-b219-425d-a17e-c38467364816 status: test description: 'Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip author: Pawel Mazur date: 2021-10-01 modified: 2022-10-09 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -t a4|startswith: image/ a5: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / registry_set. Rule: title: UAC Bypass Using Windows Media Player - Registry id: 5f9db380-ea57-4d1e-beab-8a2d33397e93 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe Details: Binary Data condition: selection falsepositives: - Unknown level: high
Query: explain T1014 Rootkit
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1108 Redundant Access. Tactics: stealth, persistence. Description: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.** Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated. If one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary's tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications. Use of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.