alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re in logs
Matching passage: Sigma rule: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution id: 42a993dd-bb3e-48c8-b372-4d6684c4106c status: test description: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced. references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject author: Florian Roth (Nextron Systems) date: 2022-02-25 modified: 2023-03-08 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.discovery - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.t1110 - attack.t1201 logsource: category: process_creation product: windows detection: selection_binary: Image|endswith: \crackmapexec.exe selection_special: CommandLine|contains: ' -M pe_inject ' selection_execute: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -x ' selection_hash: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' - ' -H ''NTHASH''' selection_module_mssql: CommandLine|contains|all: - ' mssql ' - ' -u ' - ' -p ' - ' -M ' - ' -d ' selection_module_smb1: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -H ' - ' -M ' - ' -o ' selection_module_smb2: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -p ' - ' --local-auth' part_localauth_1: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' part_localauth_2: CommandLine|contains|all: - ' 10.' - ' 192.168.' - '/24 ' condition: 1 of selection_* or all of part_localauth* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be. Logsource: windows / registry_set. Rule: title: Potential Persistence Via MyComputer Registry Keys id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06 status: test description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example) references: - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2024-01-11 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer TargetObject|endswith: (Default) condition: selection falsepositives: - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for level: high
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects a potentially suspicious execution of a process located in the '/tmp/' folder. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Execution From Tmp Folder id: 312b42b1-bded-4441-8b58-163a3af58775 status: test description: Detects a potentially suspicious execution of a process located in the '/tmp/' folder references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 modified: 2025-08-05 tags: - attack.stealth - attack.t1036 logsource: product: linux category: process_creation detection: selection: Image|startswith: /tmp/ filter_optional_nextcloud: Image|endswith: /usr/bin/nextcloud condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server acce. Logsource: windows / process_creation. Rule: title: Microsoft IIS Connection Strings Decryption id: 97dbf6e2-e436-44d8-abee-4261b24d3e41 status: test description: Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. references: - https://www.elastic.co/guide/en/security/current/microsoft-iis-connection-strings-decryption.html author: Tim Rauch, Elastic (idea) date: 2022-09-28 modified: 2022-12-30 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: \aspnet_regiis.exe - OriginalFileName: aspnet_regiis.exe selection_args: CommandLine|contains|all: - connectionStrings - ' -pdf' condition: all of selection* falsepositives: - Unknown level: high
Query: secure coding against Assignment of a Fixed Address to a Pointer
Matching passage: CWE-587 Assignment of a Fixed Address to a Pointer. The product sets a pointer to a specific address other than NULL or 0.
Near-miss passage: CWE-106 Struts: Plug-in Framework not in Use. When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
Query: rule covering Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to ga
Matching passage: Sigma rule: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to ga. Logsource: windows / process_creation. Rule: title: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS id: 575dce0c-8139-4e30-9295-1ee75969f7fe related: - id: f92a6f1e-a512-4a15-9735-da09e78d7273 type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: blueteamer8699 date: 2022-01-03 modified: 2023-02-08 tags: - attack.discovery - attack.execution - attack.t1615 - attack.t1059.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: gatherNetworkInfo.vbs condition: all of selection_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav sha. Logsource: windows / process_creation. Rule: title: Suspicious Remote Child Process From Outlook id: e212d415-0e93-435f-9e1a-f29005bb4723 related: - id: 208748f7-881d-47ac-a29c-07ea84bf691d type: similar status: test description: Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares). references: - https://github.com/sensepost/ruler - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49 author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) date: 2018-12-27 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \outlook.exe Image|startswith: \\\\ condition: selection falsepositives: - Unknown level: high
Query: exploit A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init
Matching passage: CVE-2015-10013. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-2064. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) c, or (3) redirect parameter to index.php or (4) search field (searchTerm parameter) in the main page.
Query: risk of Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrat
Matching passage: CVE-2015-1424. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Near-miss passage: CVE-2015-7612. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.
Query: write Sigma for Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
Matching passage: Sigma rule: Detect use of Get-GPO to get one GPO or all the GPOs in a domain.. Logsource: windows / ps_script. Rule: title: Suspicious GPO Discovery With Get-GPO id: eb2fd349-ec67-4caa-9143-d79c7fb34441 status: test description: Detect use of Get-GPO to get one GPO or all the GPOs in a domain. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps author: frack113 date: 2022-06-04 tags: - attack.discovery - attack.t1615 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-GPO condition: selection falsepositives: - Legitimate PowerShell scripts level: low
Near-miss passage: Sigma rule: Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files. Logsource: windows / process_creation. Rule: title: Use Icacls to Hide File to Everyone id: 4ae81040-fc1c-4249-bfa3-938d260214d9 status: test description: Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files references: - https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/ author: frack113 date: 2022-07-18 modified: 2024-04-29 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_icacls: - OriginalFileName: iCACLS.EXE - Image|endswith: \icacls.exe selection_cmd: CommandLine|contains|all: - /deny - '*S-1-1-0:' condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-1978
Matching passage: CVE-2015-1978. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-5269. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.
Query: adversary uses Malicious Image
Matching passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Near-miss passage: T1204 User Execution. Tactics: execution. Description: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). Adversaries may also deceive users into performing actions such as: * Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) * Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204) * Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn) For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Tools](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)
Query: detect This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health in logs
Matching passage: Sigma rule: This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health. Logsource: windows / security. Rule: title: Azure AD Health Monitoring Agent Registry Keys Access id: ff151c33-45fa-475d-af4f-c2f93571f4fe status: test description: 'This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent. ' references: - https://o365blog.com/post/hybridhealthagent/ - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2022-10-09 tags: - attack.discovery - attack.t1012 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectType: Key ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent filter: ProcessName|contains: - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe - Microsoft.Identity.Health.Adfs.InsightsService.exe - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe - Microsoft.Identity.Health.Adfs.PshSurrogate.exe - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity. Logsource: windows / process_creation. Rule: title: Uncommon FileSystem Load Attempt By Format.com id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60 status: test description: 'Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs. ' references: - https://twitter.com/0gtweet/status/1477925112561209344 - https://twitter.com/wdormann/status/1478011052130459653?s=20 author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2024-05-13 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \format.com CommandLine|contains: '/fs:' filter_main_known_fs: CommandLine|contains: - /fs:exFAT - /fs:FAT - /fs:NTFS - /fs:ReFS - /fs:UDF condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-5232
Matching passage: CVE-2015-5232. CWE: CWE-362. CVSS: 8.100000381469727. Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Near-miss passage: CVE-2015-0609. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCuj96752.
Query: weakness Insufficient or Incomplete Data Removal within Hardware Component
Matching passage: CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component. The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.
Near-miss passage: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Query: describe CVE-2015-10045
Matching passage: CVE-2015-10045. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
Near-miss passage: CVE-2015-5703. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: describe CVE-2015-7537
Matching passage: CVE-2015-7537. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
Near-miss passage: CVE-2015-6373. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611.
Query: describe CVE-2015-0201
Matching passage: CVE-2015-0201. CWE: CWE-254. CVSS: 5.0. The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
Near-miss passage: CVE-2015-6999. CWE: CWE-254. CVSS: 5.0. The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate.
Query: exploit Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.
Matching passage: CVE-2015-4629. CWE: CWE-264. CVSS: 9.800000190734863. Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.
Near-miss passage: CVE-2015-4394. CWE: CWE-264. CVSS: 5.0. The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive private field information via unspecified vectors.