alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I
Matching passage: Sigma rule: Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I. Logsource: windows / dns_query. Rule: title: AppX Package Installation Attempts Via AppInstaller.EXE id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a related: - id: 180c7c5c-d64b-4a63-86e9-68910451bc8b type: derived status: test description: 'Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL ' references: - https://twitter.com/notwhickey/status/1333900137232523264 - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: frack113 date: 2021-11-24 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: dns_query detection: selection: Image|startswith: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_ Image|endswith: \AppInstaller.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases. Logsource: windows / ps_script. Rule: title: Usage Of Web Request Commands And Cmdlets - ScriptBlock id: 1139d2e2-84b1-4226-b445-354492eba8ba related: - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d type: derived status: test description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs references: - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/ - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell author: James Pemberton / @4A616D6573 date: 2019-10-24 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - '[System.Net.WebRequest]::create' - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - Resume-BitsTransfer - Start-BitsTransfer - 'wget ' - WinHttp.WinHttpRequest filter: Path|startswith: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ condition: selection and not filter falsepositives: - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer. level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load o. Logsource: windows / process_creation. Rule: title: Tasks Folder Evasion id: cc4e02ba-9c06-48e2-b09e-2500cace9ae0 status: test description: 'The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr ' references: - https://twitter.com/subTee/status/1216465628946563073 - https://gist.github.com/am0nsec/8378da08f848424e4ab0cc5b317fdd26 author: Sreeman date: 2020-01-13 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection1: CommandLine|contains: - 'echo ' - 'copy ' - 'type ' - file createnew selection2: CommandLine|contains: - ' C:\Windows\System32\Tasks\' - ' C:\Windows\SysWow64\Tasks\' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious command line reg.exe tool adding key to RUN key in Registry. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Run Keys Using Reg.EXE id: de587dce-915e-4218-aac4-835ca6af6f70 status: test description: Detects suspicious command line reg.exe tool adding key to RUN key in Registry references: - https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/ - https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-06-28 modified: 2025-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - reg - ' add ' CommandLine|contains: - Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run condition: selection falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons. - Legitimate administrator sets up autorun keys for legitimate reasons. - Discord level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_add_run_key/info.yml
Query: alert when Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the
Matching passage: Sigma rule: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the. Logsource: proxy. Rule: title: F5 BIG-IP iControl Rest API Command Execution - Proxy id: b59c98c6-95e8-4d65-93ee-f594dfb96b17 related: - id: 85254a62-22be-4239-b79c-2ec17e566c37 type: similar status: test description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP references: - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029 - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516 author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-11-08 tags: - attack.initial-access - attack.t1190 logsource: category: proxy detection: selection: cs-method: POST c-uri|endswith: /mgmt/tm/util/bash condition: selection falsepositives: - Legitimate usage of the BIG IP REST API to execute command for administration purposes level: medium
Near-miss passage: Sigma rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer. Logsource: windows / process_creation. Rule: title: Deletion of Volume Shadow Copies via WMI with PowerShell id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40 related: - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e type: derived - id: c1337eb8-921a-4b59-855b-4ba188ddcc42 type: similar status: test description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-20 modified: 2022-12-30 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_get: CommandLine|contains: - Get-WmiObject - gwmi - Get-CimInstance - gcim selection_shadowcopy: CommandLine|contains: Win32_ShadowCopy selection_delete: CommandLine|contains: - .Delete() - Remove-WmiObject - rwmi - Remove-CimInstance - rcim condition: all of selection* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-9319
Matching passage: CVE-2015-9319. CWE: CWE-79. CVSS: 6.099999904632568. The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Near-miss passage: CVE-2015-0876. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld.
Matching passage: CVE-2015-4904. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld.
Near-miss passage: CVE-2015-4867. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server, a different vulnerability than CVE-2015-4880.
Query: secure coding against Improper Neutralization of Null Byte or NUL Character
Matching passage: CWE-158 Improper Neutralization of Null Byte or NUL Character. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
Near-miss passage: CWE-1284 Improper Validation of Specified Quantity in Input. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Query: CVE similar to CVE-2015-1148
Matching passage: CVE-2015-1148. CWE: CWE-200. CVSS: 5.0. Screen Sharing in Apple OS X before 10.10.3 stores the password of a user in a log file, which might allow context-dependent attackers to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-0757. CWE: CWE-200. CVSS: 5.0. The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
Query: describe CVE-2015-7649
Matching passage: CVE-2015-7649. CWE: CWE-119. CVSS: 10.0. Adobe Shockwave Player before 12.2.1.171 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-4002. CWE: CWE-119. CVSS: 9.0. drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.
Matching passage: CVE-2015-5540. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-0289. CWE: UNKNOWN. CVSS: 5.0. The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
Query: common weakness: Suspicious Comment
Matching passage: CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
Near-miss passage: CWE-1300 Improper Protection of Physical Side Channels. The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.
Query: Encoded PowerShell / command-line abuse matching Mavinject
Matching passage: T1218.013 Mavinject. Tactics: stealth. Description: Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject) Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its <code>/HMODULE</code> command-line parameter (ex. <code>mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER</code>). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)
Near-miss passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML 
Matching passage: CVE-2015-1621. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-2883. CWE: CWE-79. CVSS: 5.400000095367432. Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, 
Matching passage: CVE-2015-9204. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, if cchFriendlyName is greater than TZ_PR_MAX_NAME_LEN in function playready_leavedomain_generate_challenge(), a buffer overread occurs.
Near-miss passage: CVE-2015-5804. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: patch priority for CVE-2015-3807
Matching passage: CVE-2015-3807. CWE: CWE-119. CVSS: 4.300000190734863. libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted XML document.
Near-miss passage: CVE-2015-7730. CWE: CWE-119. CVSS: 10.0. SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial of service (out-of-bounds read and listener crash) via a crafted GIOP packet, aka SAP Security Note 2001108.
Query: CVE similar to CVE-2015-1064
Matching passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: mitigate Portable Executable Injection
Matching passage: T1055.002 Portable Executable Injection. Tactics: stealth, privilege escalation. Description: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.004 Asynchronous Procedure Call. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process. APC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point <code>QueueUserAPC</code> can be used to invoke a function (such as <code>LoadLibrayA</code> pointing to a malicious DLL). A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process.
Query: Sigma rule for Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Matching passage: Sigma rule: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation. Logsource: windows / process_creation. Rule: title: Suspicious MSDT Parent Process id: 7a74da6b-ea76-47db-92cc-874ad90df734 status: test description: Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ author: Nextron Systems date: 2022-06-01 modified: 2023-02-06 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \wmic.exe - \wscript.exe - \wsl.exe selection_msdt: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PsExec service installation and execution events. Logsource: windows / system. Rule: title: PsExec Service Installation id: 42c575ea-e41e-41f1-b248-8093c3e82a28 status: test description: Detects PsExec service installation and execution events references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-12 modified: 2023-08-04 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: PSEXESVC - ImagePath|endswith: \PSEXESVC.exe condition: all of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-6531
Matching passage: CVE-2015-6531. CWE: CWE-94. CVSS: 7.800000190734863. Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file.
Near-miss passage: CVE-2015-1675. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.