alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: macos / process_creation. Rule: title: Decode Base64 Encoded Text -MacOs id: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: macos detection: selection: Image: /usr/bin/base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege. Logsource: windows / driver_load. Rule: title: Vulnerable WinRing0 Driver Load id: 1a42dfa6-6cb2-4df9-9b48-295be477e835 status: test description: Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation references: - https://github.com/xmrig/xmrig/tree/master/bin/WinRing0 - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ author: Florian Roth (Nextron Systems) date: 2022-07-26 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - Hashes|contains: IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7 - ImageLoaded|endswith: - \WinRing0x64.sys - \WinRing0.sys - \WinRing0.dll - \WinRing0x64.dll - \winring00x64.sys condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Cont
Matching passage: Sigma rule: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Cont. Logsource: windows / application. Rule: title: Atera Agent Installation id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43 status: test description: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators references: - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent author: Bhabesh Raj date: 2021-09-01 modified: 2022-12-25 tags: - attack.command-and-control - attack.t1219.002 logsource: service: application product: windows detection: selection: EventID: 1033 Provider_Name: MsiInstaller Message|contains: AteraAgent condition: selection falsepositives: - Legitimate Atera agent installation level: high
Near-miss passage: Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high
Query: rule covering Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attac
Matching passage: Sigma rule: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attac. Logsource: windows / process_creation. Rule: title: HackTool - CreateMiniDump Execution id: 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d status: test description: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine references: - https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass author: Florian Roth (Nextron Systems) date: 2019-12-22 modified: 2024-11-23 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \CreateMiniDump.exe - Hashes|contains: IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of. Logsource: windows / process_creation. Rule: title: Detection of PowerShell Execution via Sqlps.exe id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3 status: test description: 'This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. ' references: - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/ - https://twitter.com/bryon_/status/975835709587075072 author: Agro (@agro_sev) oscd.community date: 2020-10-10 modified: 2022-12-09 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \sqlps.exe selection_image: - Image|endswith: \sqlps.exe - OriginalFileName: sqlps.exe filter_image: ParentImage|endswith: \sqlagent.exe condition: selection_parent or (selection_image and not filter_image) falsepositives: - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action. level: medium
Query: vulnerability: SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to ex
Matching passage: CVE-2015-7857. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
Near-miss passage: CVE-2015-4967. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-4056
Matching passage: CVE-2015-4056. CWE: CWE-310. CVSS: 6.699999809265137. The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access.
Near-miss passage: CVE-2015-2902. CWE: CWE-310. CVSS: 6.800000190734863. HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate.
Query: describe CVE-2015-2501
Matching passage: CVE-2015-2501. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7937. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Query: common weakness: Path Traversal: '/../filedir'
Matching passage: CWE-25 Path Traversal: '/../filedir'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /../ sequences that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-441 Unintended Proxy or Intermediary ('Confused Deputy'). The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
Query: risk of Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
Matching passage: CVE-2015-4697. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
Near-miss passage: CVE-2015-4350. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Query: describe CVE-2015-1217
Matching passage: CVE-2015-1217. CWE: CWE-17. CVSS: 7.5. The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Near-miss passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM89
Matching passage: CVE-2015-9191. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Near-miss passage: CVE-2015-2297. CWE: CWE-476. CVSS: 7.5. nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Authorization header.
Query: explain T1561.001 Disk Content Wipe
Matching passage: T1561.001 Disk Content Wipe. Tactics: impact. Description: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have also been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)
Near-miss passage: T1561 Disk Wipe. Tactics: impact. Description: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)
Query: Persistence mechanism resembling Disk Wipe
Matching passage: T1561 Disk Wipe. Tactics: impact. Description: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)
Near-miss passage: T1561.002 Disk Structure Wipe. Tactics: impact. Description: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco) To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
Query: containment actions for EDR alert: possible Cached Domain Credentials (T1003.005)
Matching passage: Playbook for T1003.005 Cached Domain Credentials. 1) Validate alert telemetry against T1003.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds) On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be alt
Near-miss passage: Playbook for T1003.001 LSASS Memory. Different response path focused on credential access.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects presence of a potentially xor encoded powershell command. Logsource: windows / process_creation. Rule: title: Suspicious XOR Encoded PowerShell Command id: bb780e0c-16cf-4383-8383-1e5471db6cf9 related: - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6 type: obsolete status: test description: Detects presence of a potentially xor encoded powershell command references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://redcanary.com/blog/yellow-cockatoo/ - https://zero2auto.com/2020/05/19/netwalker-re/ - https://mez0.cc/posts/cobaltstrike-powershell-exec/ author: Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali date: 2018-09-05 modified: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - Description: Windows PowerShell - Product: PowerShell Core 6 selection_cli_xor: CommandLine|contains: bxor selection_cli_other: CommandLine|contains: - ForEach - for( - 'for ' - '-join ' - -join' - -join" - -join` - ::Join - '[char]' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. T. Logsource: windows / process_creation. Rule: title: Write Protect For Storage Disabled id: 75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13 status: test description: 'Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group. ' references: - https://www.manageengine.com/products/desktop-central/os-imaging-deployment/media-is-write-protected.html author: Sreeman date: 2021-06-11 modified: 2024-01-18 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control - Write Protection - '0' - storage condition: selection falsepositives: - Unknown level: medium
Query: write Sigma for Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to preven
Matching passage: Sigma rule: Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to preven. Logsource: windows / registry_set. Rule: title: Driver Added To Disallowed Images In HVCI - Registry id: 555155a2-03bf-4fe7-af74-d176b3fdbe16 related: - id: 44cee399-f6b1-45cc-a87c-ea14c6064d6b type: similar status: test description: 'Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading. ' references: - https://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf - https://x.com/yarden_shafir/status/1822667605175324787 author: Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe) date: 2023-12-05 modified: 2024-08-21 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \Control\CI\ - \HVCIDisallowedImages condition: selection falsepositives: - Legitimate usage of this key would also trigger this. Investigate the driver being added and make sure its intended level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Query: risk of Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for request
Matching passage: CVE-2015-3366. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete an alfresco node via unspecified vectors.
Near-miss passage: CVE-2015-9431. CWE: CWE-352. CVSS: 6.5. The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.