alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering detects BPFDoor .lock and .pid files access in temporary file storage facility
Matching passage: Sigma rule: detects BPFDoor .lock and .pid files access in temporary file storage facility. Logsource: linux / auditd. Rule: title: BPFDoor Abnormal Process ID or Lock File Accessed id: 808146b2-9332-4d78-9416-d7e47012d83d status: test description: detects BPFDoor .lock and .pid files access in temporary file storage facility references: - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor - https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/ - https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh author: Rafal Piasecki date: 2022-08-10 modified: 2026-03-30 tags: - attack.execution - attack.t1106 - attack.t1059 logsource: product: linux service: auditd detection: selection: type: PATH name: - /var/run/aepmonend.pid - /var/run/auditd.lock - /var/run/cma.lock - /var/run/console-kit.pid - /var/run/consolekit.pid - /var/run/daemon.pid - /var/run/hald-addon.pid - /var/run/hald-smartd.pid - /var/run/haldrund.pid - /var/run/hp-health.pid - /var/run/hpasmlit.lock - /var/run/hpasmlited.pid - /var/run/kdevrund.pid - /var/run/lldpad.lock - /var/run/mcelog.pid - /var/run/system.pid - /var/run/uvp-srv.pid - /var/run/vmtoolagt.pid - /var/run/xinetd.lock condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org. Logsource: windows / process_creation. Rule: title: Chromium Browser Headless Execution To Mockbin Like Site id: 1c526788-0abe-4713-862f-b520da5e5316 status: test description: Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data). references: - https://www.zscaler.com/blogs/security-research/steal-it-campaign author: X__Junior (Nextron Systems) date: 2023-09-11 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_headless: CommandLine|contains: --headless selection_url: CommandLine|contains: - ://run.mocky - ://mockbin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml
Query: detection rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Matching passage: Sigma rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Manage Engine ServiceDesk id: cea2b7ea-792b-405f-95a1-b903ea06458f status: test description: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service references: - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py - https://blog.viettelcybersecurity.com/saml-show-stopper/ author: Florian Roth (Nextron Systems) date: 2023-01-18 modified: 2023-08-29 tags: - attack.command-and-control - attack.t1102 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - \ManageEngine\ServiceDesk\ - \java.exe Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \calc.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \query.exe - \reg.exe - \schtasks.exe - \scrcons.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe filter_main_net: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: ' stop' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate sub processes started by Manage Engine ServiceDesk Pro level: high
Near-miss passage: Sigma rule: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute. Logsource: windows / process_creation. Rule: title: Perl Inline Command Execution id: f426547a-e0f7-441a-b63e-854ac5bdf54d status: test description: Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \perl.exe - OriginalFileName: perl.exe selection_cli: CommandLine|contains: ' -e' condition: all of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266.
Matching passage: CVE-2015-4206. CWE: CWE-79. CVSS: 4.300000190734863. Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266.
Near-miss passage: CVE-2015-0123. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122.
Query: exploit Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-4429. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-3126.
Near-miss passage: CVE-2015-4824. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: patch priority for CVE-2015-1225
Matching passage: CVE-2015-1225. CWE: CWE-119. CVSS: 5.0. PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Near-miss passage: CVE-2015-1859. CWE: CWE-119. CVSS: 6.800000190734863. Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
Query: Sigma rule for Detects when an account is disabled or blocked for sign in but tried to log in
Matching passage: Sigma rule: Detects when an account is disabled or blocked for sign in but tried to log in. Logsource: azure / signinlogs. Rule: title: Account Disabled or Blocked for Sign in Attempts id: 4afac85c-224a-4dd7-b1af-8da40e1c60bd status: test description: Detects when an account is disabled or blocked for sign in but tried to log in references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts author: Yochana Henderson, '@Yochana-H' date: 2022-06-17 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: Failure condition: selection falsepositives: - Account disabled or blocked in error - Automation account has been blocked or disabled level: medium
Near-miss passage: Sigma rule: Files with well-known filenames (sensitive files with credential data) copying. Logsource: windows / process_creation. Rule: title: Copying Sensitive Files with Credential Data id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f status: test description: Files with well-known filenames (sensitive files with credential data) copying references: - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/ - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/ - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2019-10-22 modified: 2024-06-04 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 - car.2013-07-001 - attack.s0404 logsource: category: process_creation product: windows detection: selection_esent_img: - Image|endswith: \esentutl.exe - OriginalFileName: \esentutl.exe selection_esent_cli: CommandLine|contains|windash: - vss - ' /m ' - ' /y ' selection_susp_paths: CommandLine|contains: - \config\RegBack\sam - \config\RegBack\security - \config\RegBack\system - \config\sam - \config\security - '\config\system ' - \repair\sam - \repair\security - \repair\system - \windows\ntds\ntds.dit condition: all of selection_esent_* or selection_susp_paths falsepositives: - Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator. level: high
Query: adversary uses Code Signing
Matching passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Near-miss passage: T1553.003 SIP and Trust Provider Hijacking. Tactics: defense impairment. Description: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017) Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017) Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017) * Modifying the <code>Dll</code> and <code>FuncName</code> Registry values in <code>HKLM\SOFTWARE
Query: explain CWE-159
Matching passage: CWE-159 Improper Handling of Invalid Use of Special Elements. The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.
Near-miss passage: CWE-319 Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Query: Sigma rule for Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: EventLog EVTX File Deleted id: 63c779ba-f638-40a0-a593-ddd45e8b1ddc status: test description: Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ TargetFilename|endswith: .evtx condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential. Logsource: windows / process_creation. Rule: title: Private Keys Reconnaissance Via CommandLine Tools id: 213d6a77-3d55-4ce8-ba74-fcfef741974e status: test description: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.004/T1552.004.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-07-20 modified: 2023-03-06 tags: - attack.credential-access - attack.t1552.004 logsource: category: process_creation product: windows detection: selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: 'dir ' selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: 'Get-ChildItem ' selection_findstr: - Image|endswith: \findstr.exe - OriginalFileName: FINDSTR.EXE selection_ext: CommandLine|contains: - .key - .pgp - .gpg - .ppk - .p12 - .pem - .pfx - .cer - .p7b - .asc condition: selection_ext and (all of selection_cmd_* or all of selection_pwsh_* or selection_findstr) falsepositives: - Unknown level: medium
Query: write Sigma for Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Matching passage: Sigma rule: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities. Logsource: windows / process_creation. Rule: title: Potential AMSI Bypass Using NULL Bits id: 92a974db-ab84-457f-9ec0-55db83d7a825 related: - id: fa2559c8-1197-471d-9cdd-05a0273d4522 type: similar status: test description: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities references: - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 modified: 2023-05-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - if(0){{{0}}}' -f $(0 -as [char]) + - '#<NULL>' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen. Logsource: windows / process_creation. Rule: title: Potential Powershell ReverseShell Connection id: edc2f8ae-2412-4dfd-b9d5-0c57727e70be status: stable description: Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other. references: - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Shells/Invoke-PowerShellTcpOneLine.ps1 author: FPT.EagleEye, wagga, Nasreddine Bencherchali (Nextron Systems) date: 2021-03-03 modified: 2023-04-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cli: CommandLine|contains|all: - ' Net.Sockets.TCPClient' - .GetStream( - .Write( condition: all of selection_* falsepositives: - In rare administrative cases, this function might be used to check network connectivity level: high
Query: exploit Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.
Matching passage: CVE-2015-2055. CWE: CWE-20. CVSS: 7.800000190734863. Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.
Near-miss passage: CVE-2015-8711. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
Query: Encoded PowerShell / command-line abuse matching System Script Proxy Execution
Matching passage: T1216 System Script Proxy Execution. Tactics: stealth. Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)
Near-miss passage: T1216.002 SyncAppvPublishingServer. Tactics: stealth. Description: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv) The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv) Adversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv) `SyncAppvPublishingServer.vbs "n; {PowerShell}"`
Query: vulnerability: program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when u
Matching passage: CVE-2015-5382. CWE: CWE-200. CVSS: 6.5. program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Near-miss passage: CVE-2015-1456. CWE: CWE-200. CVSS: 4.0. Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/.