alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
Matching passage: Sigma rule: Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.. Logsource: windows / process_creation. Rule: title: HackTool - SharpLDAPmonitor Execution id: 9f8fc146-1d1a-4dbf-b8fd-dfae15e08541 status: test description: Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects. references: - https://github.com/p0dalirius/LDAPmonitor author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-30 modified: 2023-02-14 tags: - attack.discovery logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \SharpLDAPmonitor.exe - OriginalFileName: SharpLDAPmonitor.exe selection_cli: CommandLine|contains|all: - '/user:' - '/pass:' - '/dcip:' condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers. Logsource: windows / process_creation. Rule: title: Suspicious Modification Of Scheduled Tasks id: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b related: - id: 614cf376-6651-47c4-9dcc-6b9527f749f4 type: similar status: test description: 'Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it''s often the most focused on Instead they modify the task after creation to include their malicious payload ' references: - Internal Research - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-28 modified: 2022-11-18 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains|all: - ' /Change ' - ' /TN ' selection_susp_locations: CommandLine|contains: - \AppData\Local\Temp - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ - '%ProgramData%' - '%appdata%' - '%comspec%' - '%localappdata%' selection_susp_images: CommandLine|contains: - regsvr32 - rundll32 - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' - powershell - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe - 'hh ' condition: all of selection_* falsepositives: - Unknown level: high
Query: alert when Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Matching passage: Sigma rule: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - SSH New Connection Attempt id: cd55f721-5623-4663-bd9b-5229cab5237d status: test description: Detects instances where an SSH service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.privilege-escalation - attack.initial-access - attack.lateral-movement - attack.persistence - attack.stealth - attack.t1133 - attack.t1021 - attack.t1078 logsource: category: application product: opencanary detection: selection: logtype: 4000 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file v. Logsource: windows / file_event. Rule: title: Potential RipZip Attack on Startup Folder id: a6976974-ea6f-4e97-818e-ea08625c52cb status: test description: 'Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation. ' references: - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19 author: Greg (rule) date: 2022-07-21 modified: 2023-01-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - \Microsoft\Windows\Start Menu\Programs\Startup - .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} Image|endswith: \explorer.exe condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0239
Matching passage: CVE-2015-0239. CWE: CWE-269. CVSS: 4.400000095367432. The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.
Near-miss passage: CVE-2015-5071. CWE: CWE-269. CVSS: 6.5. AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.
Query: detect Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom D in logs
Matching passage: Sigma rule: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom D. Logsource: windows / image_load. Rule: title: UAC Bypass Using Iscsicpl - ImageLoad id: 9ed5959a-c43c-4c59-84e3-d28628429456 status: test description: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH% references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC - https://twitter.com/wdormann/status/1547583317410607110 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2022-07-25 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: image_load detection: selection: Image: C:\Windows\SysWOW64\iscsicpl.exe ImageLoaded|endswith: \iscsiexe.dll filter: ImageLoaded|contains|all: - C:\Windows\ - iscsiexe.dll condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Out Of Domain Email Forwarding id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5 status: experimental description: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse. references: - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain author: Tom kluter date: 2026-04-28 tags: - attack.t1114.003 - attack.collection logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: email_forwarding_out_of_domain condition: selection falsepositives: - Legitimate forwarding level: medium
Query: risk of ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
Matching passage: CVE-2015-2221. CWE: CWE-399. CVSS: 5.0. ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
Near-miss passage: CVE-2015-0335. CWE: CWE-399. CVSS: 10.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0339.
Query: patch priority for CVE-2015-0363
Matching passage: CVE-2015-0363. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration Business Services.
Near-miss passage: CVE-2015-1249. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: risk of KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
Matching passage: CVE-2015-0889. CWE: UNKNOWN. CVSS: 7.5. KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
Near-miss passage: CVE-2015-4363. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the finder_form_goto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Query: risk of Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.
Matching passage: CVE-2015-5606. CWE: CWE-20. CVSS: 7.5. Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.
Near-miss passage: CVE-2015-3411. CWE: CWE-20. CVSS: 6.5. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
Query: SIEM correlation: command and control activity consistent with File Transfer Protocols
Matching passage: T1071.002 File Transfer Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Near-miss passage: T1071.005 Publish/Subscribe Protocols. Tactics: command and control. Description: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as <code>MQTT</code>, <code>XMPP</code>, <code>AMQP</code>, and <code>STOMP</code> use a publish/subscribe design, with message distribution managed by a centralized broker.(Citation: wailing crab sub/pub)(Citation: Mandiant APT1 Appendix) Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics.(Citation: wailing crab sub/pub) An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic.
Query: describe CVE-2015-0462
Matching passage: CVE-2015-0462. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-7464. CWE: UNKNOWN. CVSS: 7.5. Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to cause a denial of service (Report Builder server outage) via a crafted request to a Report Builder instance URL.
Query: detect Detects the execution of PowerShell via the creation of a named pipe starting with PSHost in logs
Matching passage: Sigma rule: Detects the execution of PowerShell via the creation of a named pipe starting with PSHost. Logsource: windows / pipe_created. Rule: title: New PowerShell Instance Created id: ac7102b4-9e1e-4802-9b4f-17c5524c015c related: - id: 58cb02d5-78ce-4692-b3e1-dce850aae41a type: derived status: test description: Detects the execution of PowerShell via the creation of a named pipe starting with PSHost references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-09-12 modified: 2023-11-30 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PSHost condition: selection falsepositives: - Likely level: informational
Near-miss passage: Sigma rule: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz. Logsource: windows / security. Rule: title: Successful Overpass the Hash Attempt id: 192a0330-c20b-4356-90b6-7b7049ae0b87 status: test description: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. references: - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html author: Roberto Rodriguez (source), Dominik Schaudel (rule) date: 2018-02-12 modified: 2021-11-27 tags: - attack.lateral-movement - attack.s0002 - attack.t1550.002 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: seclogo AuthenticationPackageName: Negotiate condition: selection falsepositives: - Runas command-line tool using /netonly parameter level: high
Query: CVE similar to CVE-2015-3772
Matching passage: CVE-2015-3772. CWE: CWE-119. CVSS: 7.199999809265137. IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3769 and CVE-2015-3771.
Near-miss passage: CVE-2015-5786. CWE: CWE-119. CVSS: 6.800000190734863. Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.
Query: risk of Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter i
Matching passage: CVE-2015-4074. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
Near-miss passage: CVE-2015-1198. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
Query: describe CVE-2015-4142
Matching passage: CVE-2015-4142. CWE: CWE-119. CVSS: 4.300000190734863. Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-6599. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
Query: CWE for Expected Behavior Violation
Matching passage: CWE-440 Expected Behavior Violation. A feature, API, or function does not perform according to its specification.
Near-miss passage: CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions. The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
Query: mitigate Component Object Model Hijacking
Matching passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Near-miss passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Query: vulnerability: Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vecto
Matching passage: CVE-2015-3383. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Near-miss passage: CVE-2015-8638. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.