alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Matching passage: Sigma rule: Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.. Logsource: windows / file_event. Rule: title: HackTool - Mimikatz Kirbi File Creation id: 9e099d99-44c2-42b6-a6d8-54c3545cab29 related: - id: 034affe8-6170-11ec-844f-0f78aa0c4d66 type: obsolete status: test description: Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc. references: - https://cobalt.io/blog/kerberoast-attack-techniques - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ author: Florian Roth (Nextron Systems), David ANDRE date: 2021-11-08 modified: 2024-06-27 tags: - attack.credential-access - attack.t1558 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .kirbi - mimilsa.log condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit polic. Logsource: windows / process_creation. Rule: title: Audit Policy Tampering Via NT Resource Kit Auditpol id: c6c56ada-612b-42d1-9a29-adad3c5c2c1e related: - id: 0a13e132-651d-11eb-ae93-0242ac130002 type: similar status: test description: 'Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability. This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor. ' references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-21 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - /logon:none - /system:none - /sam:none - /privilege:none - /object:none - /process:none - /policy:none condition: selection falsepositives: - The old auditpol utility isn't available by default on recent versions of Windows as it was replaced by a newer version. The FP rate should be very low except for tools that use a similar flag structure level: high
Query: describe CVE-2015-9293
Matching passage: CVE-2015-9293. CWE: CWE-79. CVSS: 6.099999904632568. The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Near-miss passage: CVE-2015-1390. CWE: CWE-79. CVSS: 6.099999904632568. Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
Query: vulnerability: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Matching passage: CVE-2015-9008. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Near-miss passage: CVE-2015-1590. CWE: CWE-264. CVSS: 7.800000190734863. The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
Query: Sigma rule for Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val
Matching passage: Sigma rule: Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val. Logsource: windows / process_creation. Rule: title: New Remote Desktop Connection Initiated Via Mstsc.EXE id: 954f0af7-62dd-418f-b3df-a84bc2c7a774 status: test description: 'Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc author: frack113 date: 2022-01-07 modified: 2024-06-04 tags: - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|contains|windash: ' /v:' filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - WSL (Windows Sub System For Linux) level: medium
Near-miss passage: Sigma rule: Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads. Logsource: windows / ps_script. Rule: title: PowerShell Write-EventLog Usage id: 35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e status: test description: Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads to the EventLog and then retrieve them later for later use references: - https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 tags: - attack.defense-impairment logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Write-EventLog - '-RawData ' condition: selection falsepositives: - Legitimate applications writing events via this cmdlet. Investigate alerts to determine if the action is benign level: medium
Query: exploit The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9359. CWE: CWE-79. CVSS: 6.099999904632568. The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-8006. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PageTriage toolbar in the PageTriage extension for MediWiki allows remote attackers to inject arbitrary web script or HTML via the page title.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious mshta process execution patterns. Logsource: windows / process_creation. Rule: title: Suspicious Mshta.EXE Execution Patterns id: e32f92d1-523e-49c3-9374-bdb13b46a3ba status: test description: Detects suspicious mshta process execution patterns references: - https://en.wikipedia.org/wiki/HTML_Application - https://www.echotrail.io/insights/search/mshta.exe - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-17 modified: 2023-02-21 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_susp: ParentImage|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe CommandLine|contains: - \AppData\Local\ - C:\ProgramData\ - C:\Users\Public\ - C:\Windows\Temp\ filter_img: - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - CommandLine|contains: - .htm - .hta - CommandLine|endswith: - mshta.exe - mshta condition: all of selection_* or (selection_img and not filter_img) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled. Logsource: aws / cloudtrail. Rule: title: AWS EnableRegion Command Monitoring id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab status: experimental description: 'Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment. ' references: - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html author: Ivan Saakov, Sergey Zelenskiy date: 2025-10-19 tags: - attack.persistence logsource: product: aws service: cloudtrail detection: selection: eventName: EnableRegion eventSource: account.amazonaws.com condition: selection falsepositives: - Legitimate use of the EnableRegion command by authorized administrators. level: medium
Query: explain CWE-514
Matching passage: CWE-514 Covert Channel. A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.
Near-miss passage: CWE-196 Unsigned to Signed Conversion Error. The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
Query: rule covering Detects S3 Browser utility creating IAM User or AccessKey.
Matching passage: Sigma rule: Detects S3 Browser utility creating IAM User or AccessKey.. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser User or AccessKey Creation id: db014773-d9d9-4792-91e5-133337c0ffee status: test description: Detects S3 Browser utility creating IAM User or AccessKey. references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.initial-access - attack.stealth - attack.t1059.009 - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: - CreateUser - CreateAccessKey userAgent|contains: S3 Browser condition: selection falsepositives: - Valid usage of S3 Browser for IAM User and/or AccessKey creation level: high
Near-miss passage: Sigma rule: Detects a network connection initiated by "Regsvr32.exe". Logsource: windows / network_connection. Rule: title: Network Connection Initiated By Regsvr32.EXE id: c7e91a02-d771-4a6d-a700-42587e0b1095 status: test description: Detects a network connection initiated by "Regsvr32.exe" references: - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/ - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/ author: Dmitriy Lifanov, oscd.community date: 2019-10-25 modified: 2023-09-18 tags: - attack.execution - attack.stealth - attack.t1559.001 - attack.t1218.010 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \regsvr32.exe condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6382
Matching passage: CVE-2015-6382. CWE: CWE-399. CVSS: 5.0. Cisco ASR 5000 devices with software 16.0(900) allow remote attackers to cause a denial of service (telnetd process restart) via a TELNET connection, aka Bug ID CSCuv25815.
Near-miss passage: CVE-2015-1081. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: write Sigma for Detects the execution of DeviceCredentialDeployment to hide a process from view.
Matching passage: Sigma rule: Detects the execution of DeviceCredentialDeployment to hide a process from view.. Logsource: windows / process_creation. Rule: title: DeviceCredentialDeployment Execution id: b8b1b304-a60f-4999-9a6e-c547bde03ffd status: test description: 'Detects the execution of DeviceCredentialDeployment to hide a process from view. ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/147 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \DeviceCredentialDeployment.exe condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow ". Logsource: windows / process_creation. Rule: title: Remote File Download Via Findstr.EXE id: 587254ee-a24b-4335-b3cd-065c0f1f4baa related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_download_1: CommandLine|contains|windash: ' -v ' selection_cli_download_2: CommandLine|contains|windash: ' -l ' selection_cli_download_3: CommandLine|contains: \\\\ condition: selection_findstr and all of selection_cli_download_* falsepositives: - Unknown level: medium
Query: vulnerability: Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.
Matching passage: CVE-2015-5696. CWE: CWE-20. CVSS: 5.0. Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.
Near-miss passage: CVE-2015-1787. CWE: CWE-20. CVSS: 2.5999999046325684. The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
Query: risk of Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related
Matching passage: CVE-2015-0363. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration Business Services.
Near-miss passage: CVE-2015-1249. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than C
Matching passage: CVE-2015-4822. CWE: UNKNOWN. CVSS: 1.2000000476837158. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4831.
Near-miss passage: CVE-2015-4804. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Management component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: describe CVE-2015-2953
Matching passage: CVE-2015-2953. CWE: CWE-264. CVSS: 5.0. Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to bypass intended access restrictions and read files via unspecified vectors, a different vulnerability than CVE-2015-2952 and CVE-2015-2958.
Near-miss passage: CVE-2015-4165. CWE: CWE-264. CVSS: 7.5. The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Query: risk of SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the t
Matching passage: CVE-2015-6512. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.
Near-miss passage: CVE-2015-7235. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal. Logsource: windows / ps_script. Rule: title: Automated Collection Bookmarks Using Get-ChildItem PowerShell id: e0565f5d-d420-4e02-8a68-ac00d864f9cf status: test description: 'Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113 date: 2021-12-13 modified: 2022-12-25 tags: - attack.discovery - attack.t1217 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ChildItem - ' -Recurse ' - ' -Path ' - ' -Filter Bookmarks' - ' -ErrorAction SilentlyContinue' - ' -Force' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Attackers may leverage fsutil to enumerated connected drives.. Logsource: windows / process_creation. Rule: title: Fsutil Drive Enumeration id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6 status: test description: Attackers may leverage fsutil to enumerated connected drives. references: - Turla has used fsutil fsinfo drives to list connected drives. - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2022-03-29 modified: 2022-07-14 tags: - attack.discovery - attack.t1120 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: drives condition: all of selection_* falsepositives: - Certain software or administrative tasks may trigger false positives. level: low
Query: describe CVE-2015-1625
Matching passage: CVE-2015-1625. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1634.
Near-miss passage: CVE-2015-1750. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1747, and CVE-2015-1753.
Query: telemetry for T1090.004
Matching passage: T1090.004 Domain Fronting. Tactics: command and control. Description: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: describe CVE-2015-0638
Matching passage: CVE-2015-0638. CWE: CWE-20. CVSS: 7.099999904632568. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.
Near-miss passage: CVE-2015-2754. CWE: CWE-20. CVSS: 6.800000190734863. FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."