alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Lateral movement indicators for Launchd
Matching passage: T1053.004 Launchd. Tactics: execution, persistence, privilege escalation. Description: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. Adversaries may abuse the <code>Launchd</code> daemon to perform task scheduling for initial or recurring execution of malicious code. The <code>launchd</code> daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). An adversary may use the <code>launchd</code> daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. <code>launchd</code> can also be abused to run a process under the context of a specified account. Daemons, such as <code>launchd</code>, run with the permissions of the root user account, and will operate regardless of which user account is logged in.
Near-miss passage: T1053.007 Container Orchestration Job. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)
Query: alert when Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over
Matching passage: Sigma rule: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over. Logsource: windows / security. Rule: title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security id: c39f0c81-7348-4965-ab27-2fde35a1b641 status: test description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-12 modified: 2022-11-26 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: \Internet Explorer\iertutil.dll filter: SubjectUserName|endswith: $ condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to. Logsource: windows / msexchange-management. Rule: title: Mailbox Export to Exchange Webserver id: 516376b4-05cd-4122-bae0-ad7641c38d48 status: test description: Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it references: - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) date: 2021-08-09 modified: 2023-04-30 tags: - attack.persistence - attack.t1505.003 logsource: service: msexchange-management product: windows detection: export_command: '|all': - New-MailboxExportRequest - ' -Mailbox ' export_params: - -FilePath "\\\\ - .aspx role_assignment: '|all': - New-ManagementRoleAssignment - ' -Role "Mailbox Import Export"' - ' -User ' condition: (export_command and export_params) or role_assignment falsepositives: - Unlikely level: critical
Query: vulnerability: The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF
Matching passage: CVE-2015-8790. CWE: CWE-200. CVSS: 4.300000190734863. The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access.
Near-miss passage: CVE-2015-4213. CWE: CWE-200. CVSS: 4.0. Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391.
Query: exploit Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via vectors rela
Matching passage: CVE-2015-4828. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via vectors related to FIN Resource Management (Security).
Near-miss passage: CVE-2015-0321. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
Query: Suspicious Cron execution detected on endpoint
Matching passage: T1053.003 Cron. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths. An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)
Near-miss passage: T1053.002 At. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. In addition to explicitly running the `at` command, adversaries may also schedule a task with [at](https://attack.mitre.org/software/S0110) by directly leveraging the [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) `Win32_ScheduledJob` WMI class.(Citation: Malicious Life by Cybereason) On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the <code>at.allow</code> file. If the <code>at.allow</code> file does not exist, the <code>at.deny</code> file is checked. Every username not listed in <code>at.deny</code> is allowed to invoke [at](https://attack.mitre.org/software/S0110). If the <code>at.deny</code> exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: Linux at) Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Move
Query: CWE for Reliance on Runtime Component in Generated Code
Matching passage: CWE-1101 Reliance on Runtime Component in Generated Code. The product uses automatically-generated code that cannot be executed without a specific runtime support component.
Near-miss passage: CWE-1094 Excessive Index Range Scan for a Data Resource. The product contains an index range scan for a large data table, but the scan can cover a large number of rows.
Query: patch priority for CVE-2015-0493
Matching passage: CVE-2015-0493. CWE: UNKNOWN. CVSS: 1.5. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0474.
Near-miss passage: CVE-2015-8322. CWE: UNKNOWN. CVSS: 8.800000190734863. NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Query: Sigma rule for Detects a driver load from a temporary directory
Matching passage: Sigma rule: Detects a driver load from a temporary directory. Logsource: windows / driver_load. Rule: title: Driver Load From A Temporary Directory id: 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75 status: test description: Detects a driver load from a temporary directory references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-02-12 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: driver_load product: windows detection: selection: ImageLoaded|contains: \Temp\ condition: selection falsepositives: - There is a relevant set of false positives depending on applications in the environment level: high
Near-miss passage: Sigma rule: Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, a. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Admission Controller id: a61a3c56-4ce2-4351-a079-88ae4cbd2b58 status: test description: 'Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.credential-access - attack.t1552 - attack.t1552.007 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO operationName|endswith: - /MUTATINGWEBHOOKCONFIGURATIONS/WRITE - /VALIDATINGWEBHOOKCONFIGURATIONS/WRITE condition: selection falsepositives: - Azure Kubernetes Admissions Controller may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: rule covering Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
Matching passage: Sigma rule: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring". Logsource: windows / windefend. Rule: title: Microsoft Defender Tamper Protection Trigger id: 49e5bc24-8b86-49f1-b743-535f332c2856 status: stable description: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring" references: - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Bhabesh Raj, Nasreddine Bencherchali date: 2021-07-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5013 Value|endswith: - \Windows Defender\DisableAntiSpyware - \Windows Defender\DisableAntiVirus - \Windows Defender\Scan\DisableArchiveScanning - \Windows Defender\Scan\DisableScanningNetworkFiles - \Real-Time Protection\DisableRealtimeMonitoring - \Real-Time Protection\DisableBehaviorMonitoring - \Real-Time Protection\DisableIOAVProtection - \Real-Time Protection\DisableScriptScanning condition: selection falsepositives: - Administrator might try to disable defender features during testing (must be investigated) level: high
Near-miss passage: Sigma rule: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is us. Logsource: windows / security. Rule: title: Suspicious PsExec Execution id: c462f537-a1e3-41a6-b5fc-b2c2cef9bf82 status: test description: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one references: - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html author: Samir Bousseaden date: 2019-04-03 modified: 2022-08-11 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName|endswith: - -stdin - -stdout - -stderr filter: RelativeTargetName|startswith: PSEXESVC condition: selection1 and not filter falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6980
Matching passage: CVE-2015-6980. CWE: CWE-264. CVSS: 7.800000190734863. Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-3235. CWE: CWE-264. CVSS: 6.0. Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords via unspecified vectors.
Query: CVE similar to CVE-2015-9275
Matching passage: CVE-2015-9275. CWE: CWE-22. CVSS: 5.300000190734863. ARC 5.21q allows directory traversal via a full pathname in an archive file.
Near-miss passage: CVE-2015-4461. CWE: CWE-22. CVSS: 6.5. Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.
Query: detection rule: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Matching passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution From Uncommon Parent id: ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6 status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations. references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.lateral-movement logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \brave.exe - \CCleanerBrowser.exe - \chrome.exe - \chromium.exe - \firefox.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \opera.exe - \vivaldi.exe - \whale.exe - \outlook.exe selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executabl. Logsource: windows / process_creation. Rule: title: Windows MSIX Package Support Framework AI_STUBS Execution id: af5732ed-764e-489d-826d-0447c8b36242 status: experimental description: 'Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename ''popupwrapper.exe''. This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions. ' references: - https://redcanary.com/blog/threat-intelligence/msix-installers/ - https://redcanary.com/threat-detection-report/techniques/installer-packages/ - https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.stealth - attack.defense-impairment - attack.t1218 - attack.t1553.005 - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \AI_STUBS\AiStubX64Elevated.exe - \AI_STUBS\AiStubX86Elevated.exe - \AI_STUBS\AiStubX64.exe - \AI_STUBS\AiStubX86.exe OriginalFileName: popupwrapper.exe condition: selection falsepositives: - Legitimate applications packaged with Advanced Installer using Package Support Framework level: low
Query: vulnerability: Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9365. CWE: CWE-79. CVSS: 6.099999904632568. Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Query: write Sigma for Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and othe
Matching passage: Sigma rule: Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and othe. Logsource: windows / windefend. Rule: title: Windows Defender Grace Period Expired id: 360a1340-398a-46b6-8d06-99b905dc69d2 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: 'Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled. ' references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5101 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.. Logsource: windows / process_creation. Rule: title: Use of Wfc.exe id: 49be8799-7b4d-4fda-ad23-cafbefdebbc5 status: test description: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \wfc.exe - OriginalFileName: wfc.exe condition: selection falsepositives: - Legitimate use by a software developer level: medium
Query: patch priority for CVE-2015-1959
Matching passage: CVE-2015-1959. CWE: CWE-284. CVSS: 4.599999904632568. IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action.
Near-miss passage: CVE-2015-1376. CWE: CWE-284. CVSS: 4.0. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.