alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo
Matching passage: Sigma rule: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Shebang In CLI id: fe2f9663-41cb-47e2-b954-8a228f3b9dff status: test description: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - IyEvYmluL2Jhc2 - IyEvYmluL2Rhc2 - IyEvYmluL3pza - IyEvYmluL2Zpc2 - IyEvYmluL3No condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and s. Logsource: linux / process_creation. Rule: title: Inline Python Execution - Spawn Shell Via OS System Library id: 2d2f44ff-4611-4778-a8fc-323a0e9850cc status: test description: 'Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell. ' references: - https://gtfobins.github.io/gtfobins/python/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_cli: CommandLine|contains|all: - ' -c ' - os.system( CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: detect Detects powershell scripts that import modules from suspicious directories in logs
Matching passage: Sigma rule: Detects powershell scripts that import modules from suspicious directories. Logsource: windows / ps_script. Rule: title: Import PowerShell Modules From Suspicious Directories id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab related: - id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3 type: similar status: test description: Detects powershell scripts that import modules from suspicious directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-07 modified: 2023-01-10 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Import-Module "$Env:Temp\ - Import-Module '$Env:Temp\ - Import-Module $Env:Temp\ - Import-Module "$Env:Appdata\ - Import-Module '$Env:Appdata\ - Import-Module $Env:Appdata\ - Import-Module C:\Users\Public\ - ipmo "$Env:Temp\ - ipmo '$Env:Temp\ - ipmo $Env:Temp\ - ipmo "$Env:Appdata\ - ipmo '$Env:Appdata\ - ipmo $Env:Appdata\ - ipmo C:\Users\Public\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in. Logsource: windows / process_creation. Rule: title: Wusa.EXE Executed By Parent Process Located In Suspicious Location id: ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99 status: test description: 'Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges. ' references: - https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document author: X__Junior (Nextron Systems) date: 2023-11-26 modified: 2024-08-15 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wusa.exe selection_paths_1: ParentImage|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ - \Temporary Internet selection_paths_2: - ParentImage|contains|all: - :\Users\ - \Favorites\ - ParentImage|contains|all: - :\Users\ - \Favourites\ - ParentImage|contains|all: - :\Users\ - \Contacts\ - ParentImage|contains|all: - :\Users\ - \Pictures\ filter_main_msu: CommandLine|contains: .msu condition: selection_img and 1 of selection_paths_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-8719
Matching passage: CVE-2015-8719. CWE: CWE-20. CVSS: 5.5. The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS dissector in Wireshark 1.12.x before 1.12.9 mishandles the EDNS0 Client Subnet option, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8562. CWE: CWE-20. CVSS: 7.5. Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Query: weakness Improper Neutralization of Input Terminators
Matching passage: CWE-147 Improper Neutralization of Input Terminators. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
Near-miss passage: CWE-1174 ASP.NET Misconfiguration: Improper Model Validation. The ASP.NET application does not use, or incorrectly uses, the model validation framework.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD
Matching passage: CVE-2015-9218. CWE: CWE-388. CVSS: 5.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, when processing bad HEVC clips, the DPB fills, and with no error handling for DPB being full, a hang occurs.
Near-miss passage: CVE-2015-9120. CWE: CWE-388. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, detection of Error Condition Without Action in Core.
Query: rule covering Detects attempts to create and add an account to the admin group via "dscl"
Matching passage: Sigma rule: Detects attempts to create and add an account to the admin group via "dscl". Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via Dscl id: b743623c-2776-40e0-87b1-682b975d0ca5 related: - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b type: obsolete status: test description: Detects attempts to create and add an account to the admin group via "dscl" references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos - https://ss64.com/osx/dscl.html author: Sohan G (D4rkCiph3r) date: 2023-03-19 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dscl CommandLine|contains|all: - ' -append ' - ' /Groups/admin ' - ' GroupMembership ' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.. Logsource: windows / process_creation. Rule: title: Share And Session Enumeration Using Net.EXE id: 62510e69-616b-4078-b371-847da438cc03 status: stable description: Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag. references: - https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Endgame, JHasenbusch (ported for oscd.community) date: 2018-10-30 modified: 2023-02-21 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains: view filter: CommandLine|contains: \\\\ condition: all of selection_* and not filter falsepositives: - Legitimate use of net.exe utility by legitimate user level: low
Query: patch priority for CVE-2015-1659
Matching passage: CVE-2015-1659. CWE: UNKNOWN. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1662 and CVE-2015-1665.
Near-miss passage: CVE-2015-0406. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitra
Matching passage: CVE-2015-7349. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter.
Near-miss passage: CVE-2015-5520. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account.
Query: patch priority for CVE-2015-7066
Matching passage: CVE-2015-7066. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7064.
Near-miss passage: CVE-2015-1171. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Query: intelligence brief on T1689
Matching passage: T1689 Downgrade Attack. Tactics: defense impairment. Description: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: Praetorian TLS Downgrade Attack 2014) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike downgrade attack)(Citation: Google Cloud downgrade attack)(Citation: att_def_ps_logging) Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: CrowdStrike Downgrade attack 2) On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.(Citation: SafeBreach)
Near-miss passage: T1600 Weaken Encryption. Tactics: defense impairment. Description: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.(Citation: Cisco Synful Knock Evolution) Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as [Modify System Image](https://attack.mitre.org/techniques/T1601), [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001), and [Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002), an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.(Citation: Cisco Blog Legacy Device Attacks)
Query: write Sigma for Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution
Matching passage: Sigma rule: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution. Logsource: windows / registry_set. Rule: title: Potential PowerShell Execution Policy Tampering id: fad91067-08c5-4d1a-8d8c-d96a21b37814 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar status: test description: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-12-14 tags: - attack.defense-impairment logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \ShellIds\Microsoft.PowerShell\ExecutionPolicy - \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy Details|contains: - Bypass - Unrestricted filter_main_svchost: Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should. Logsource: windows / process_creation. Rule: title: PrintBrm ZIP Creation of Extraction id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7 status: test description: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation. references: - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/ author: frack113 date: 2022-05-02 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.004 logsource: product: windows category: process_creation detection: selection: Image|endswith: \PrintBrm.exe CommandLine|contains|all: - ' -f' - .zip condition: selection falsepositives: - Unknown level: high
Query: detect Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as in logs
Matching passage: Sigma rule: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as. Logsource: windows / file_event. Rule: title: VsCode Powershell Profile Modification id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502 related: - id: b5b78988-486d-4a80-b991-930eff3ff8bf type: similar status: test description: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2023-01-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \Microsoft.VSCode_profile.ps1 condition: selection falsepositives: - Legitimate use of the profile by developers or administrators level: medium
Near-miss passage: Sigma rule: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud VPN Tunnel Modified or Deleted id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1 status: test description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. references: - https://any-api.com/googleapis_com/compute/docs/vpnTunnels author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - compute.vpnTunnels.insert - compute.vpnTunnels.delete condition: selection falsepositives: - VPN Tunnel being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: write Sigma for Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati
Matching passage: Sigma rule: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati. Logsource: windows / file_delete. Rule: title: Backup Files Deleted id: 06125661-3814-4e03-bfa2-1e4411c60ac3 status: test description: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files author: frack113 date: 2022-01-02 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: product: windows category: file_delete detection: selection: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wt.exe - \rundll32.exe - \regsvr32.exe TargetFilename|endswith: - .VHD - .bac - .bak - .wbcat - .bkf - .set - .win - .dsk condition: selection falsepositives: - Legitimate usage level: medium
Near-miss passage: Sigma rule: Detects an issue in apache logs that reports threading related errors. Logsource: apache. Rule: title: Apache Threading Error id: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c status: test description: Detects an issue in apache logs that reports threading related errors references: - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md author: Florian Roth (Nextron Systems) date: 2019-01-22 modified: 2021-11-27 tags: - attack.initial-access - attack.lateral-movement - attack.t1190 - attack.t1210 logsource: service: apache definition: 'Requirements: Must be able to collect the error.log file' detection: keywords: - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)' condition: keywords falsepositives: - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185 level: medium
Query: CVE similar to CVE-2015-9073
Matching passage: CVE-2015-9073. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Near-miss passage: CVE-2015-9020. CWE: CWE-476. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory.
Query: describe CVE-2015-5301
Matching passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Near-miss passage: CVE-2015-6850. CWE: CWE-264. CVSS: 8.399999618530273. EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session.
Query: CWE for Reliance on Reverse DNS Resolution for a Security-Critical Action
Matching passage: CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action. The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
Near-miss passage: CWE-192 Integer Coercion Error. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
Query: explain CWE-1189
Matching passage: CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC). The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
Near-miss passage: CWE-278 Insecure Preserved Inherited Permissions. A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.