alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc in logs
Matching passage: Sigma rule: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc. Logsource: windows / image_load. Rule: title: DLL Load By System Process From Suspicious Locations id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c status: test description: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public" references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2023-09-18 tags: - attack.stealth - attack.t1070 logsource: product: windows category: image_load detection: selection: Image|startswith: C:\Windows\ ImageLoaded|startswith: - C:\Users\Public\ - C:\PerfLogs\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading using comctl32.dll to obtain system privileges. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via comctl32.dll id: 6360757a-d460-456c-8b13-74cf0e60cceb status: test description: Detects potential DLL sideloading using comctl32.dll to obtain system privileges references: - https://github.com/binderlabs/DirCreate2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash) date: 2022-12-16 modified: 2022-12-19 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|startswith: - C:\Windows\System32\logonUI.exe.local\ - C:\Windows\System32\werFault.exe.local\ - C:\Windows\System32\consent.exe.local\ - C:\Windows\System32\narrator.exe.local\ - C:\windows\system32\wermgr.exe.local\ ImageLoaded|endswith: \comctl32.dll condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8404. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-6834. CWE: UNKNOWN. CVSS: 9.800000190734863. Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
Query: detection engineering for Portable Executable Injection
Matching passage: T1055.002 Portable Executable Injection. Tactics: stealth, privilege escalation. Description: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.003 Thread Execution Hijacking. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point the process can be suspended then written to, realigned to the injected code, and resumed via <code>SuspendThread </code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation: Elastic Process Injection July 2017) This is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Query: explain CWE-313
Matching passage: CWE-313 Cleartext Storage in a File or on Disk. The product stores sensitive information in cleartext in a file, or on disk.
Near-miss passage: CWE-805 Buffer Access with Incorrect Length Value. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Query: vulnerability: Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL
Matching passage: CVE-2015-4371. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
Near-miss passage: CVE-2015-0428. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Resource Control.
Query: weakness Use of HTTP Request With Sensitive Query String
Matching passage: CWE-598 Use of HTTP Request With Sensitive Query String. The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Near-miss passage: CWE-926 Improper Export of Android Application Components. The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Query: detection rule: Detects the creation of a new office macro files on the systems
Matching passage: Sigma rule: Detects the creation of a new office macro files on the systems. Logsource: windows / file_event. Rule: title: Office Macro File Creation id: 91174a41-dc8f-401b-be89-7bfc140612a0 related: - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 type: similar status: test description: Detects the creation of a new office macro files on the systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2026-01-09 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm filter_main_office: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ Image|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.EXE TargetFilename|contains: \~$ condition: selection and not 1 of filter_main_* falsepositives: - Very common in environments that rely heavily on macro documents level: low
Near-miss passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: Firewall Configuration Discovery Via Netsh.EXE id: 0e4164da-94bc-450d-a7be-a4b176179f1f status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules - https://ss64.com/nt/netsh.html author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-12-07 modified: 2025-10-18 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - netsh - 'show ' - 'firewall ' CommandLine|contains: - 'config ' - 'state ' - 'rule ' - name=all condition: all of selection_* falsepositives: - Administrative activity level: low
Query: rule covering Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage
Matching passage: Sigma rule: Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage. Logsource: windows / security. Rule: title: Uncommon Outbound Kerberos Connection - Security id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 related: - id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74 type: similar status: test description: 'Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. ' references: - https://github.com/GhostPack/Rubeus author: Ilyas Ochkov, oscd.community date: 2019-10-24 modified: 2024-03-15 tags: - attack.lateral-movement - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 5156 DestPort: 88 filter_main_lsass: Application|startswith: - \device\harddiskvolume - 'C:' Application|endswith: \Windows\System32\lsass.exe filter_optional_chrome: Application|startswith: - \device\harddiskvolume - 'C:' Application|endswith: - \Program Files (x86)\Google\Chrome\Application\chrome.exe - \Program Files\Google\Chrome\Application\chrome.exe filter_optional_firefox: Application|startswith: - \device\harddiskvolume - 'C:' Application|endswith: - \Program Files (x86)\Mozilla Firefox\firefox.exe - \Program Files\Mozilla Firefox\firefox.exe filter_optional_tomcat: Application|endswith: \tomcat\bin\tomcat8.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Web Browsers and third party application might generate similar activity. An initial baseline is required. level: medium
Near-miss passage: Sigma rule: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by usi. Logsource: windows / process_creation. Rule: title: Esentutl Steals Browser Information id: 6a69f62d-ce75-4b57-8dce-6351eb55b362 status: test description: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://redcanary.com/threat-detection-report/threats/qbot/ - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ author: frack113 date: 2022-02-13 modified: 2024-03-05 tags: - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \esentutl.exe - OriginalFileName: esentutl.exe selection_flag: CommandLine|contains|windash: -r selection_webcache: CommandLine|contains: \Windows\WebCache condition: all of selection* falsepositives: - Legitimate use level: medium
Query: Multiple failed authentications followed by Exfiltration Over Webhook
Matching passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Near-miss passage: T1567.002 Exfiltration to Cloud Storage. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Query: risk of Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and A
Matching passage: CVE-2015-7617. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code by leveraging improper EScript exception handling, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7621.
Near-miss passage: CVE-2015-1756. CWE: CWE-416. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Common Controls in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted web site that is accessed with the F12 Developer Tools feature of Internet Explorer, aka "Microsoft Common Control Use After Free Vulnerability."
Query: vulnerability: The Telephony subsystem in Apple iOS before 8.4 allows physically proximate attackers to execute arbitrary code via a crafted (1) SIM or (2) UIM card.
Matching passage: CVE-2015-3726. CWE: CWE-20. CVSS: 4.599999904632568. The Telephony subsystem in Apple iOS before 8.4 allows physically proximate attackers to execute arbitrary code via a crafted (1) SIM or (2) UIM card.
Near-miss passage: CVE-2015-0638. CWE: CWE-20. CVSS: 7.099999904632568. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145.
Query: exploit The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass inte
Matching passage: CVE-2015-7521. CWE: CWE-287. CVSS: 8.300000190734863. The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
Near-miss passage: CVE-2015-5998. CWE: CWE-287. CVSS: 10.0. Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allo
Matching passage: CVE-2015-7320. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8815. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to (1) the media page, (2) the developer data edit page, or (3) the form page.
Query: Sigma rule for Detects commandline operations on shell history files
Matching passage: Sigma rule: Detects commandline operations on shell history files. Logsource: macos / process_creation. Rule: title: Suspicious History File Operations id: 508a9374-ad52-4789-b568-fc358def2c65 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.003 logsource: product: macos category: process_creation detection: selection: CommandLine|contains: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: selection falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Near-miss passage: Sigma rule: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should. Logsource: windows / process_creation. Rule: title: PrintBrm ZIP Creation of Extraction id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7 status: test description: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation. references: - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/ author: frack113 date: 2022-05-02 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.004 logsource: product: windows category: process_creation detection: selection: Image|endswith: \PrintBrm.exe CommandLine|contains|all: - ' -f' - .zip condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-0864
Matching passage: CVE-2015-0864. CWE: CWE-264. CVSS: 8.0. Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
Near-miss passage: CVE-2015-1327. CWE: CWE-264. CVSS: 7.800000190734863. Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
Query: ATT&CK technique for Archive via Custom Method
Matching passage: T1560.003 Archive via Custom Method. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Near-miss passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)