alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with M
Matching passage: Sigma rule: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with M. Logsource: windows / process_creation. Rule: title: Potential Privilege Escalation via Service Permissions Weakness id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981 status: test description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - Medium - S-1-16-8192 CommandLine|contains|all: - ControlSet - services CommandLine|contains: - \ImagePath - \FailureCommand - \ServiceDll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusi. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE id: 48917adc-a28e-4f5d-b729-11e75da8941f status: test description: Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData. references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ author: frack113 date: 2022-02-13 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths - SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths CommandLine|contains|all: - 'ADD ' - '/t ' - 'REG_DWORD ' - '/v ' - '/d ' - '0' condition: selection falsepositives: - Legitimate use level: medium
Query: describe CVE-2015-1432
Matching passage: CVE-2015-1432. CWE: CWE-352. CVSS: 6.800000190734863. The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Near-miss passage: CVE-2015-0588. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055.
Query: command and control using Bidirectional Communication
Matching passage: T1102.002 Bidirectional Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Near-miss passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: describe CVE-2015-7615
Matching passage: CVE-2015-7615. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in a SaveAs feature in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-5706. CWE: CWE-416. CVSS: 4.599999904632568. Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.
Query: alert when An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take
Matching passage: Sigma rule: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take. Logsource: windows / ps_script. Rule: title: Replace Desktop Wallpaper by Powershell id: c5ac6a1e-9407-45f5-a0ce-ca9a0806a287 status: test description: 'An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md author: frack113 date: 2021-12-26 tags: - attack.impact - attack.t1491.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_1: ScriptBlockText|contains|all: - Get-ItemProperty - 'Registry::' - HKEY_CURRENT_USER\Control Panel\Desktop\ - WallPaper selection_2: ScriptBlockText|contains: SystemParametersInfo(20,0,*,3) condition: 1 of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects PAExec service installation. Logsource: windows / system. Rule: title: PAExec Service Installation id: de7ce410-b3fb-4e8a-b38c-3b999e2c3420 status: test description: Detects PAExec service installation references: - https://www.poweradmin.com/paexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_image: - ServiceName|startswith: PAExec- - ImagePath|startswith: C:\WINDOWS\PAExec- condition: all of selection_* falsepositives: - Unknown level: medium
Query: detect Exploitation for Stealth
Matching passage: T1211 Exploitation for Stealth. Tactics: stealth. Description: Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)
Near-miss passage: T1542.002 Component Firmware. Tactics: stealth, persistence. Description: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking. Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
Query: describe CVE-2015-9307
Matching passage: CVE-2015-9307. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Near-miss passage: CVE-2015-3350. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors.
Query: patch priority for CVE-2015-7984
Matching passage: CVE-2015-7984. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary (1) commands via the cmd parameter to admin/cmdshell.php, (2) SQL queries via the sql parameter to admin/sqlshell.php, or (3) PHP code via the php parameter to admin/phpshell.php.
Near-miss passage: CVE-2015-1585. CWE: CWE-352. CVSS: 6.800000190734863. Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.
Query: CVE similar to CVE-2015-9145
Matching passage: CVE-2015-9145. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, lack of input validation in NPA driver functions leads to null pointer dereference.
Near-miss passage: CVE-2015-9038. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end.
Query: vulnerability: Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to s
Matching passage: CVE-2015-8087. CWE: CWE-399. CVSS: 5.0. Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."
Near-miss passage: CVE-2015-4226. CWE: CWE-399. CVSS: 7.099999904632568. The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered, aka Bug ID CSCur39976.
Query: exploit IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerabil
Matching passage: CVE-2015-3769. CWE: CWE-119. CVSS: 7.199999809265137. IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3771 and CVE-2015-3772.
Near-miss passage: CVE-2015-7500. CWE: CWE-119. CVSS: 5.0. The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.
Query: detection rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p
Matching passage: Sigma rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p. Logsource: windows / process_creation. Rule: title: New Capture Session Launched Via DXCap.EXE id: 60f16a96-db70-42eb-8f76-16763e333590 status: test description: 'Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/ - https://twitter.com/harr0ey/status/992008180904419328 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2022-06-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \DXCap.exe - OriginalFileName: DXCap.exe selection_cli: CommandLine|contains: ' -c ' condition: all of selection* falsepositives: - Legitimate execution of dxcap.exe by legitimate user level: medium
Near-miss passage: Sigma rule: Detects when an a role is modified or deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Modified or Deleted id: 6aef64e3-60c6-4782-8db3-8448759c714e status: test description: Detects when an a role is modified or deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - DELETE_ROLE - RENAME_ROLE - UPDATE_ROLE condition: selection falsepositives: - Unknown level: medium
Query: detect Detects MSI package installation from suspicious locations in logs
Matching passage: Sigma rule: Detects MSI package installation from suspicious locations. Logsource: windows / application. Rule: title: MSI Installation From Suspicious Locations id: c7c8aa1c-5aff-408e-828b-998e3620b341 status: test description: Detects MSI package installation from suspicious locations references: - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1040 - 1042 Data|contains: - :\Windows\TEMP\ - \\\\ - \Desktop\ - \PerfLogs\ - \Users\Public\ filter_winget: Data|contains: \AppData\Local\Temp\WinGet\ filter_updhealthtools: Data|contains: C:\Windows\TEMP\UpdHealthTools.msi condition: selection and not 1 of filter_* falsepositives: - False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use. level: medium
Near-miss passage: Sigma rule: Detects the rare use of the command line tool shutdown to logoff a user. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Shutdown to Log Out id: ec290c06-9b6b-4338-8b6b-095c0f284f10 status: test description: Detects the rare use of the command line tool shutdown to logoff a user references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown author: frack113 date: 2022-10-01 tags: - attack.impact - attack.t1529 logsource: category: process_creation product: windows detection: selection: Image|endswith: \shutdown.exe CommandLine|contains: /l condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-8544
Matching passage: CVE-2015-8544. CWE: CWE-200. CVSS: 7.5. NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-2817. CWE: CWE-200. CVSS: 5.0. The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
Query: describe CVE-2015-2846
Matching passage: CVE-2015-2846. CWE: CWE-77. CVSS: 9.300000190734863. BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.
Near-miss passage: CVE-2015-0778. CWE: CWE-77. CVSS: 7.5. osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
Query: risk of edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
Matching passage: CVE-2015-5601. CWE: CWE-434. CVSS: 8.800000190734863. edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
Near-miss passage: CVE-2015-9259. CWE: CWE-434. CVSS: 9.800000190734863. In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy. Logsource: windows / process_creation. Rule: title: Potential Suspicious Activity Using SeCEdit id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb status: test description: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy references: - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit author: Janantha Marasinghe date: 2022-11-18 modified: 2022-12-30 tags: - attack.collection - attack.discovery - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1685.001 - attack.t1547.001 - attack.t1505.005 - attack.t1556.002 - attack.t1685 - attack.t1574.007 - attack.t1564.002 - attack.t1546.008 - attack.t1546.007 - attack.t1547.014 - attack.t1547.010 - attack.t1547.002 - attack.t1557 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \secedit.exe - OriginalFileName: SeCEdit selection_flags_discovery: CommandLine|contains|all: - /export - /cfg selection_flags_configure: CommandLine|contains|all: - /configure - /db condition: selection_img and (1 of selection_flags_*) falsepositives: - Legitimate administrative use level: medium
Near-miss passage: Sigma rule: Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. Logsource: linux / process_creation. Rule: title: Pnscan Binary Data Transmission Activity id: 97de11cd-4b67-4abf-9a8b-1020e670aa9e status: test description: 'Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT ' author: David Burkett (@signalblur) date: 2024-04-16 references: - https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence - https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf - https://regex101.com/r/RugQYK/1 - https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: linux detection: selection: CommandLine|re: -(W|R)\s?(\s|"|')([0-9a-fA-F]{2}\s?){2,20}(\s|"|') condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-7055
Matching passage: CVE-2015-7055. CWE: CWE-284. CVSS: 9.300000190734863. AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Near-miss passage: CVE-2015-9152. CWE: CWE-284. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile IPQ4019, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 800, SD 810, SD 820, SD 820A, SD 835, and Snapdragon_High_Med_2016, modem owned regions are accessible from secure side.