alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.
Matching passage: Sigma rule: Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.. Logsource: windows / file_event. Rule: title: .RDP File Created By Uncommon Application id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: derived status: test description: 'Detects creation of a file with an ".rdp" extension by an application that doesn''t commonly create such files. ' references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 modified: 2024-11-01 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .rdp Image|endswith: - \brave.exe - \CCleaner Browser\Application\CCleanerBrowser.exe - \chromium.exe - \firefox.exe - \Google\Chrome\Application\chrome.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \Opera.exe - \Vivaldi.exe - \Whale.exe - \olk.exe - \Outlook.exe - \RuntimeBroker.exe - \Thunderbird.exe - \Discord.exe - \Keybase.exe - \msteams.exe - \Slack.exe - \teams.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious command sequence that JexBoss. Logsource: linux. Rule: title: JexBoss Command Sequence id: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae status: test description: Detects suspicious command sequence that JexBoss references: - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A author: Florian Roth (Nextron Systems) date: 2017-08-24 modified: 2025-11-22 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: '|all': - bash -c /bin/bash - '&/dev/tcp/' condition: keywords falsepositives: - Unknown level: high
Query: describe CVE-2015-4047
Matching passage: CVE-2015-4047. CWE: CWE-476. CVSS: 7.800000190734863. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
Near-miss passage: CVE-2015-9043. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer.
Query: describe CVE-2015-1199
Matching passage: CVE-2015-1199. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in ppmd 10.1-5.
Near-miss passage: CVE-2015-8309. CWE: CWE-22. CVSS: 4.300000190734863. Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Query: patch priority for CVE-2015-3291
Matching passage: CVE-2015-3291. CWE: CWE-17. CVSS: 2.0999999046325684. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.
Near-miss passage: CVE-2015-0286. CWE: CWE-17. CVSS: 5.0. The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Query: weakness Missing Handler
Matching passage: CWE-431 Missing Handler. A handler is not available or implemented.
Near-miss passage: CWE-1287 Improper Validation of Specified Type of Input. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Query: CVE similar to CVE-2015-6049
Matching passage: CVE-2015-6049. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6048.
Near-miss passage: CVE-2015-5806. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: vulnerability: A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin
Matching passage: CVE-2015-10132. CWE: CWE-79. CVSS: 3.5. A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
Near-miss passage: CVE-2015-8861. CWE: CWE-79. CVSS: 6.099999904632568. The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Query: patch priority for CVE-2015-1984
Matching passage: CVE-2015-1984. CWE: CWE-200. CVSS: 4.0. IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks.
Near-miss passage: CVE-2015-9194. CWE: CWE-200. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, during module load at TZ Startup, memory statically allocated by modules was not being properly set to zero first. Allowing the module to execute without reset gives it access to information from previous app thus leading to information exposure.
Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: Detects extracting of zip file from image file. Logsource: linux / auditd. Rule: title: Steganography Unzip Hidden Information From Picture File id: edd595d7-7895-4fa7-acb3-85a18a8772ca status: test description: Detects extracting of zip file from image file references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: unzip a1: a1|endswith: - .jpg - .png condition: commands and a1 falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects execution of the Notepad++ updater (gup) to launch other commands or executables. Logsource: windows / process_creation. Rule: title: Arbitrary Binary Execution Using GUP Utility id: d65aee4d-2292-4cea-b832-83accd6cfa43 status: test description: Detects execution of the Notepad++ updater (gup) to launch other commands or executables references: - https://twitter.com/nas_bench/status/1535322445439180803 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \gup.exe Image|endswith: \explorer.exe filter: Image|endswith: \explorer.exe CommandLine|contains: \Notepad++\notepad++.exe filter_parent: ParentImage|contains: \Notepad++\updater\ filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Other parent binaries using GUP not currently identified level: medium
Query: intelligence brief on T1018
Matching passage: T1018 Remote System Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Near-miss passage: T1010 Application Window Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Query: Sigma YAML for okta / okta
Matching passage: Sigma rule: Detects when an Okta policy is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Policy Modified or Deleted id: 1667a172-ed4c-463c-9969-efd92195319a status: test description: Detects when an Okta policy is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.lifecycle.update - policy.lifecycle.delete condition: selection falsepositives: - Okta Policies being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects the use of the filename DumpStack.log to evade Microsoft Defender. Logsource: windows / process_creation. Rule: title: DumpStack.log Defender Evasion id: 4f647cfa-b598-4e12-ad69-c68dd16caef8 status: test description: Detects the use of the filename DumpStack.log to evade Microsoft Defender references: - https://twitter.com/mrd0x/status/1479094189048713219 author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2022-06-17 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: Image|endswith: \DumpStack.log selection_download: CommandLine|contains: ' -o DumpStack.log' condition: 1 of selection* falsepositives: - Unknown level: critical
Query: write Sigma for Detects remote RPC calls to create or execute a scheduled task via ATSvc
Matching passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task via ATSvc. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ATSvc id: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb status: test description: Detects remote RPC calls to create or execute a scheduled task via ATSvc references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.lateral-movement - attack.execution - attack.persistence - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b OpNum: - 0 - 1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Query: explain CWE-1099
Matching passage: CWE-1099 Inconsistent Naming Conventions for Identifiers. The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.
Near-miss passage: CWE-1333 Inefficient Regular Expression Complexity. The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Query: risk of epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denia
Matching passage: CVE-2015-6245. CWE: CWE-20. CVSS: 4.300000190734863. epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Near-miss passage: CVE-2015-3004. CWE: CWE-20. CVSS: 4.300000190734863. J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, and 14.2 before 14.2R1 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
Query: describe CVE-2015-0757
Matching passage: CVE-2015-0757. CWE: CWE-200. CVSS: 5.0. The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.
Near-miss passage: CVE-2015-2742. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream.
Query: playbook for alert: Outbound C2 pattern associated with Multi-Factor Authentication Request Generation
Matching passage: Playbook for T1621 Multi-Factor Authentication Request Generation. 1) Validate alert telemetry against T1621. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security cont
Near-miss passage: Playbook for T1110.002 Password Cracking. Different response path focused on credential access.
Query: detect Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows in logs
Matching passage: Sigma rule: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows. Logsource: windows / process_access. Rule: title: Suspicious Svchost Process Access id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde status: test description: Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service. references: - https://github.com/hlldz/Invoke-Phant0m - https://twitter.com/timbmsft/status/900724491076214784 author: Tim Burrell date: 2020-01-02 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: :\Windows\System32\svchost.exe GrantedAccess: '0x1F3FFF' CallTrace|contains: UNKNOWN filter_main_msbuild: SourceImage|contains: :\Program Files\Microsoft Visual Studio\ SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe CallTrace|contains: - Microsoft.Build.ni.dll - System.ni.dll condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-. Logsource: windows / process_creation. Rule: title: Terminal Service Process Spawn id: 1012f107-b8f1-4271-af30-5aed2de89b39 status: test description: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708) references: - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/ author: Florian Roth (Nextron Systems) date: 2019-05-22 modified: 2023-01-25 tags: - attack.initial-access - attack.t1190 - attack.lateral-movement - attack.t1210 - car.2013-07-002 logsource: product: windows category: process_creation detection: selection: ParentCommandLine|contains|all: - \svchost.exe - termsvcs filter_img: Image|endswith: - \rdpclip.exe - :\Windows\System32\csrss.exe - :\Windows\System32\wininit.exe - :\Windows\System32\winlogon.exe filter_null: Image: null condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of the "systeminfo" command to retrieve information. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Systeminfo id: 0ef56343-059e-4cb6-adc1-4c3c967c5e46 status: test description: Detects usage of the "systeminfo" command to retrieve information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo author: frack113 date: 2022-01-01 modified: 2022-07-14 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \systeminfo.exe - OriginalFileName: sysinfo.exe condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the spec. Logsource: aws / cloudtrail. Rule: title: AWS EC2 Startup Shell Script Change id: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df status: test description: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9 author: faloker date: 2020-02-12 modified: 2022-06-07 tags: - attack.execution - attack.t1059.001 - attack.t1059.003 - attack.t1059.004 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com requestParameters.attribute: userData eventName: ModifyInstanceAttribute condition: selection_source falsepositives: - Valid changes to the startup script level: high
Query: vulnerability: FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font fil
Matching passage: CVE-2015-6977. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Near-miss passage: CVE-2015-4484. CWE: CWE-119. CVSS: 5.0. The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.