alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / driver_load
Matching passage: Sigma rule: Detects driver load of the System Informer tool. Logsource: windows / driver_load. Rule: title: PUA - System Informer Driver Load id: 10cb6535-b31d-4512-9962-513dcbc42cc1 related: - id: 67add051-9ee7-4ad3-93ba-42935615ae8d type: similar status: test description: Detects driver load of the System Informer tool references: - https://systeminformer.sourceforge.io/ - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|endswith: \SystemInformer.sys - Hashes|contains: - SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24 - SHA256=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454 - SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D - SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B - SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D - SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34 - SHA256=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89 - SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB - SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B - SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97 - SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656 - SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4 - SHA256=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes. Logsource: windows / process_creation. Rule: title: Msxsl.EXE Execution id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0 status: test description: 'Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: medium
Query: alert when Detects the abuse of custom file open handler, executing powershell
Matching passage: Sigma rule: Detects the abuse of custom file open handler, executing powershell. Logsource: windows / registry_set. Rule: title: Custom File Open Handler Executes PowerShell id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc status: test description: Detects the abuse of custom file open handler, executing powershell references: - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728 author: CD_R0M_ date: 2022-06-11 modified: 2023-08-17 tags: - attack.stealth - attack.t1202 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: shell\open\command\ Details|contains|all: - powershell - -command condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org. Logsource: windows / process_creation. Rule: title: Chromium Browser Headless Execution To Mockbin Like Site id: 1c526788-0abe-4713-862f-b520da5e5316 status: test description: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data). references: - https://www.zscaler.com/blogs/security-research/steal-it-campaign author: X__Junior (Nextron Systems) date: 2023-09-11 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_headless: CommandLine|contains: --headless selection_url: CommandLine|contains: - ://run.mocky - ://mockbin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml
Query: write Sigma for Detects the attack technique pass the hash which is used to move laterally inside the network
Matching passage: Sigma rule: Detects the attack technique pass the hash which is used to move laterally inside the network. Logsource: windows / security. Rule: title: Pass the Hash Activity 2 id: 8eef149c-bd26-49f2-9e5a-9b00e3af499b status: stable description: Detects the attack technique pass the hash which is used to move laterally inside the network references: - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events - https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/ author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule) date: 2019-06-14 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: security definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624 detection: selection_logon3: EventID: 4624 SubjectUserSid: S-1-0-0 LogonType: 3 LogonProcessName: NtLmSsp KeyLength: 0 selection_logon9: EventID: 4624 LogonType: 9 LogonProcessName: seclogo filter: TargetUserName: ANONYMOUS LOGON condition: 1 of selection_* and not filter falsepositives: - Administrator activity level: medium
Near-miss passage: Sigma rule: Detects S3 Browser utility creating IAM User or AccessKey.. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser User or AccessKey Creation id: db014773-d9d9-4792-91e5-133337c0ffee status: test description: Detects S3 Browser utility creating IAM User or AccessKey. references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.initial-access - attack.stealth - attack.t1059.009 - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: - CreateUser - CreateAccessKey userAgent|contains: S3 Browser condition: selection falsepositives: - Valid usage of S3 Browser for IAM User and/or AccessKey creation level: high
Query: alert when Detects remote service activity via remote access to the svcctl named pipe
Matching passage: Sigma rule: Detects remote service activity via remote access to the svcctl named pipe. Logsource: windows / security. Rule: title: Remote Service Activity via SVCCTL Named Pipe id: 586a8d6b-6bfe-4ad9-9d78-888cd2fe50c3 status: test description: Detects remote service activity via remote access to the svcctl named pipe references: - https://web.archive.org/web/20230329155141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-08-01 tags: - attack.lateral-movement - attack.persistence - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName: svcctl AccessList|contains: WriteData condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / registry_set. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 related: - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a type: similar - id: 55f0a3a1-846e-40eb-8273-677371b8d912 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Query: vulnerability: Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for all
Matching passage: CVE-2015-1438. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers.
Near-miss passage: CVE-2015-3700. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3701, and CVE-2015-3702.
Query: vulnerability: Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read ar
Matching passage: CVE-2015-4632. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.
Near-miss passage: CVE-2015-0906. CWE: CWE-22. CVSS: 5.800000190734863. Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive.
Query: exploit The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding op
Matching passage: CVE-2015-0804. CWE: CWE-264. CVSS: 7.5. The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
Near-miss passage: CVE-2015-3844. CWE: CWE-264. CVSS: 6.800000190734863. The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Query: vulnerability: libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_dec
Matching passage: CVE-2015-7507. CWE: CWE-125. CVSS: 7.5. libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_decode_rle function.
Near-miss passage: CVE-2015-8920. CWE: CWE-125. CVSS: 5.5. The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.
Query: describe CVE-2015-2847
Matching passage: CVE-2015-2847. CWE: CWE-284. CVSS: 5.0. Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.
Near-miss passage: CVE-2015-0119. CWE: CWE-284. CVSS: 7.5. FastBack Mount in IBM Tivoli Storage Manager FastBack 6.1.x before 6.1.11.1 allows remote attackers to execute arbitrary code by connecting to the Mount port.
Query: exploit Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-0018. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0037, CVE-2015-0040, and CVE-2015-0066.
Near-miss passage: CVE-2015-0036. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0041.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious process patterns found in logs when CrackMapExec is used. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Process Patterns id: f26307d8-14cd-47e3-a26b-4b4769f24af6 status: test description: Detects suspicious process patterns found in logs when CrackMapExec is used references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass author: Florian Roth (Nextron Systems) date: 2022-03-12 modified: 2023-02-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_lsass_dump1: CommandLine|contains|all: - 'tasklist /fi ' - Imagename eq lsass.exe CommandLine|contains: - 'cmd.exe /c ' - 'cmd.exe /r ' - 'cmd.exe /k ' - 'cmd /c ' - 'cmd /r ' - 'cmd /k ' User|contains: - AUTHORI - AUTORI selection_lsass_dump2: CommandLine|contains|all: - do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump - \Windows\Temp\ - ' full' - '%%B' selection_procdump: CommandLine|contains|all: - tasklist /v /fo csv - findstr /i "lsass" condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a sus. Logsource: windows / process_creation. Rule: title: Potential Suspicious Mofcomp Execution id: 1dd05363-104e-4b4a-b963-196a534b03a1 status: test description: 'Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts ' references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2023-04-11 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mofcomp.exe - OriginalFileName: mofcomp.exe selection_case: - ParentImage|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \wscript.exe - \cscript.exe - CommandLine|contains: - \AppData\Local\Temp - \Users\Public\ - \WINDOWS\Temp\ - '%temp%' - '%tmp%' - '%appdata%' filter_main_wmiprvse: ParentImage: C:\Windows\System32\wbem\WmiPrvSE.exe CommandLine|contains: C:\Windows\TEMP\ CommandLine|endswith: .mof filter_optional_null_parent: CommandLine|contains: C:\Windows\TEMP\ CommandLine|endswith: .mof condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: weakness Buffer Access with Incorrect Length Value
Matching passage: CWE-805 Buffer Access with Incorrect Length Value. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Near-miss passage: CWE-493 Critical Public Variable Without Final Modifier. The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
Query: vulnerability: Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creati
Matching passage: CVE-2015-5261. CWE: CWE-119. CVSS: 7.099999904632568. Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Near-miss passage: CVE-2015-2401. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2408.
Query: telemetry for T1071.002
Matching passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Near-miss passage: T1071.003 Mail Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28)
Query: vulnerability: The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
Matching passage: CVE-2015-8285. CWE: CWE-119. CVSS: 7.5. The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
Near-miss passage: CVE-2015-8843. CWE: CWE-119. CVSS: 7.400000095367432. The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption.
Query: explain CWE-481
Matching passage: CWE-481 Assigning instead of Comparing. The code uses an operator for assignment when the intention was to perform a comparison.
Near-miss passage: CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers. The product uses the same control element across multiple architectural layers.