alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects presence of a potentially xor encoded powershell command
Matching passage: Sigma rule: Detects presence of a potentially xor encoded powershell command. Logsource: windows / process_creation. Rule: title: Suspicious XOR Encoded PowerShell Command id: bb780e0c-16cf-4383-8383-1e5471db6cf9 related: - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6 type: obsolete status: test description: Detects presence of a potentially xor encoded powershell command references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://redcanary.com/blog/yellow-cockatoo/ - https://zero2auto.com/2020/05/19/netwalker-re/ - https://mez0.cc/posts/cobaltstrike-powershell-exec/ author: Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali date: 2018-09-05 modified: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Description: Windows PowerShell - Product: PowerShell Core 6 selection_cli_xor: CommandLine|contains: bxor selection_cli_other: CommandLine|contains: - ForEach - for( - 'for ' - '-join ' - -join' - -join" - -join` - ::Join - '[char]' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects important or interesting Windows services that got terminated unexpectedly.. Logsource: windows / system. Rule: title: Important Windows Service Terminated Unexpectedly id: 56abae0c-6212-4b97-adc0-0b559bb950c3 status: test description: Detects important or interesting Windows services that got terminated unexpectedly. references: - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7034 selection_name: - param1|contains: Message Queuing - Binary|contains: - 4d0053004d005100 - 6d0073006d007100 condition: all of selection_* falsepositives: - Rare false positives could occur since service termination could happen due to multiple reasons level: high
Query: patch priority for CVE-2015-6246
Matching passage: CVE-2015-6246. CWE: CWE-20. CVSS: 4.300000190734863. The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-5296. CWE: CWE-20. CVSS: 5.400000095367432. Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Query: CVE similar to CVE-2015-8430
Matching passage: CVE-2015-8430. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-1063. CWE: UNKNOWN. CVSS: 7.800000190734863. CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.
Query: detection rule: Detects password change for the computer's domain account or host principal via "ksetup.exe"
Matching passage: Sigma rule: Detects password change for the computer's domain account or host principal via "ksetup.exe". Logsource: windows / process_creation. Rule: title: Computer Password Change Via Ksetup.EXE id: de16d92c-c446-4d53-8938-10aeef41c8b6 status: test description: Detects password change for the computer's domain account or host principal via "ksetup.exe" references: - https://twitter.com/Oddvarmoe/status/1641712700605513729 - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-06 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ksetup.exe - OriginalFileName: ksetup.exe selection_cli: CommandLine|contains: ' /setcomputerpassword ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc). Logsource: windows / image_load. Rule: title: Third Party Software DLL Sideloading id: f9df325d-d7bc-4a32-8a1a-2cc61dcefc63 status: test description: Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc) references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_lenovo: ImageLoaded|endswith: \commfunc.dll filter_lenovo: - ImageLoaded|contains: \AppData\local\Google\Chrome\Application\ - ImageLoaded|startswith: - C:\Program Files\Lenovo\Communications Utility\ - C:\Program Files (x86)\Lenovo\Communications Utility\ selection_toshiba: ImageLoaded|endswith: \tosbtkbd.dll filter_toshiba: ImageLoaded|startswith: - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\ condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba) falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-4766
Matching passage: CVE-2015-4766. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall.
Near-miss passage: CVE-2015-1853. CWE: UNKNOWN. CVSS: 6.5. chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
Query: rule covering Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Matching passage: Sigma rule: Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'. Logsource: windows / registry_set. Rule: title: COM Hijack via Sdclt id: 07743f65-7ec9-404a-a519-913db7118a8d status: test description: Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute' references: - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass - https://www.exploit-db.com/exploits/47696 author: Omkar Gudhate date: 2020-09-27 modified: 2023-09-28 tags: - attack.persistence - attack.privilege-escalation - attack.t1546 - attack.t1548 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Software\Classes\Folder\shell\open\command\DelegateExecute condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to contr. Logsource: linux / process_creation. Rule: title: Install Root Certificate id: 78a80655-a51e-4669-bc6b-e9d206a462ee status: test description: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: Ömer Günal, oscd.community date: 2020-10-05 modified: 2022-07-07 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /update-ca-certificates - /update-ca-trust condition: selection falsepositives: - Legitimate administration activities level: low
Query: describe CVE-2015-8568
Matching passage: CVE-2015-8568. CWE: CWE-772. CVSS: 6.5. Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.
Near-miss passage: CVE-2015-6697. CWE: CWE-772. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to obtain sensitive information about color objects from process memory by reading a light object's RGB data, a different vulnerability than CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Query: describe CVE-2015-3459
Matching passage: CVE-2015-3459. CWE: CWE-264. CVSS: 10.0. The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands.
Near-miss passage: CVE-2015-1293. CWE: CWE-264. CVSS: 7.5. The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Query: CVE similar to CVE-2015-7709
Matching passage: CVE-2015-7709. CWE: CWE-264. CVSS: 10.0. The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
Near-miss passage: CVE-2015-0662. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
Query: CVE similar to CVE-2015-0273
Matching passage: CVE-2015-0273. CWE: UNKNOWN. CVSS: 7.5. Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.
Near-miss passage: CVE-2015-5183. CWE: UNKNOWN. CVSS: 7.5. Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
Query: describe CVE-2015-2822
Matching passage: CVE-2015-2822. CWE: CWE-20. CVSS: 4.300000190734863. Siemens SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2 and SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2 allow man-in-the-middle attackers to cause a denial of service via crafted packets on TCP port 102.
Near-miss passage: CVE-2015-9268. CWE: CWE-20. CVSS: 7.800000190734863. Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
Query: CVE similar to CVE-2015-0544
Matching passage: CVE-2015-0544. CWE: UNKNOWN. CVSS: 9.300000190734863. EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.
Near-miss passage: CVE-2015-2014. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA.
Query: vulnerability: EMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate and (2) svcuser accounts, which makes it easier for remote attackers to obtain pot
Matching passage: CVE-2015-0529. CWE: CWE-255. CVSS: 5.0. EMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate and (2) svcuser accounts, which makes it easier for remote attackers to obtain potentially sensitive information via a login session.
Near-miss passage: CVE-2015-1320. CWE: CWE-255. CVSS: 9.800000190734863. The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Query: risk of The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak permissions for 
Matching passage: CVE-2015-8944. CWE: CWE-200. CVSS: 5.5. The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak permissions for /proc/iomem, which allows local users to obtain sensitive information by reading this file, aka Android internal bug 28814213 and Qualcomm internal bug CR786116. NOTE: the permissions may be intentional in most non-Android contexts.
Near-miss passage: CVE-2015-7456. CWE: CWE-200. CVSS: 6.5. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Query: detection rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the
Matching passage: Sigma rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the. Logsource: webserver. Rule: title: F5 BIG-IP iControl Rest API Command Execution - Webserver id: 85254a62-22be-4239-b79c-2ec17e566c37 related: - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17 type: similar status: test description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP references: - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029 - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516 author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-11-08 tags: - attack.execution - attack.t1190 - attack.initial-access logsource: category: webserver detection: selection: cs-method: POST cs-uri-query|endswith: /mgmt/tm/util/bash condition: selection falsepositives: - Legitimate usage of the BIG IP REST API to execute command for administration purposes level: medium
Near-miss passage: Sigma rule: Detects the creation of a macro file for Outlook.. Logsource: windows / file_event. Rule: title: New Outlook Macro Created id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 related: - id: 117d3d3a-755c-4a61-b23e-9171146d094c type: derived status: test description: Detects the creation of a macro file for Outlook. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ author: '@ScoubiMtl' date: 2021-04-05 modified: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: file_event product: windows detection: selection: Image|endswith: \outlook.exe TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM condition: selection falsepositives: - User genuinely creates a VB Macro for their email level: medium
Query: patch priority for CVE-2015-8113
Matching passage: CVE-2015-8113. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
Near-miss passage: CVE-2015-8401. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: risk of Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Ado
Matching passage: CVE-2015-5560. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-8875. CWE: CWE-189. CVSS: 7.800000190734863. Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.
Query: vulnerability: EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login sessi
Matching passage: CVE-2015-6850. CWE: CWE-264. CVSS: 8.399999618530273. EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session.
Near-miss passage: CVE-2015-5629. CWE: CWE-264. CVSS: 6.800000190734863. The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Query: CVE similar to CVE-2015-5384
Matching passage: CVE-2015-5384. CWE: CWE-384. CVSS: 8.800000190734863. AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.
Near-miss passage: CVE-2015-1820. CWE: CWE-384. CVSS: 9.800000190734863. REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights. Logsource: windows / process_creation. Rule: title: PsExec/PAExec Escalation to LOCAL SYSTEM id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 related: - id: 207b0396-3689-42d9-8399-4222658efc99 type: similar status: test description: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-23 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection_sys: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' selection_other: CommandLine|contains: - psexec - paexec - accepteula condition: all of selection_* falsepositives: - Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare) - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension level: high
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a. Logsource: windows / process_creation. Rule: title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d related: - id: 236d8e89-ed95-4789-a982-36f4643738ba type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_cli: CommandLine|contains|all: - ' script ' - ' set ' condition: all of selection_* falsepositives: - Unknown level: medium