alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects usage of wmic to start or stop a service
Matching passage: Sigma rule: Detects usage of wmic to start or stop a service. Logsource: windows / process_creation. Rule: title: Service Started/Stopped Via Wmic.EXE id: 0b7163dc-7eee-4960-af17-c0cd517f92da status: test description: Detects usage of wmic to start or stop a service references: - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains|all: - ' service ' - ' call ' CommandLine|contains: - stopservice - startservice condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_manipulation/info.yml
Near-miss passage: Sigma rule: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities. Logsource: windows / process_creation. Rule: title: Potential AMSI Bypass Using NULL Bits id: 92a974db-ab84-457f-9ec0-55db83d7a825 related: - id: fa2559c8-1197-471d-9cdd-05a0273d4522 type: similar status: test description: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities references: - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 modified: 2023-05-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - if(0){{{0}}}' -f $(0 -as [char]) + - '#<NULL>' condition: selection falsepositives: - Unknown level: medium
Query: what is T1614
Matching passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Near-miss passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Query: vulnerability: Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka int
Matching passage: CVE-2015-6618. CWE: CWE-254. CVSS: 4.300000190734863. Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.
Near-miss passage: CVE-2015-7188. CWE: CWE-254. CVSS: 7.5. Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string.
Query: describe CVE-2015-10115
Matching passage: CVE-2015-10115. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
Near-miss passage: CVE-2015-2749. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Query: detect Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attac in logs
Matching passage: Sigma rule: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attac. Logsource: windows / process_creation. Rule: title: HackTool - CreateMiniDump Execution id: 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d status: test description: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine references: - https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass author: Florian Roth (Nextron Systems) date: 2019-12-22 modified: 2024-11-23 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \CreateMiniDump.exe - Hashes|contains: IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lat. Logsource: windows / security. Rule: title: First Time Seen Remote Named Pipe id: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad status: test description: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes references: - https://twitter.com/menasec1/status/1104489274387451904 author: Samir Bousseaden date: 2019-04-03 modified: 2023-03-14 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ false_positives: RelativeTargetName: - atsvc - samr - lsarpc - lsass - winreg - netlogon - srvsvc - protected_storage - wkssvc - browser - netdfs - svcctl - spoolss - ntsvcs - LSM_API_service - HydraLsPipe - TermSrv_API_service - MsFteWds - sql\query - eventlog condition: selection1 and not false_positives falsepositives: - Update the excluded named pipe to filter out any newly observed legit named pipe level: high
Query: CVE similar to CVE-2015-6576
Matching passage: CVE-2015-6576. CWE: CWE-94. CVSS: 8.800000190734863. Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.
Near-miss passage: CVE-2015-5243. CWE: CWE-94. CVSS: 9.800000190734863. phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Query: exploit Cisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root privileges via unspecified commands, aka Bug ID CSCur18132.
Matching passage: CVE-2015-0767. CWE: CWE-264. CVSS: 7.199999809265137. Cisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root privileges via unspecified commands, aka Bug ID CSCur18132.
Near-miss passage: CVE-2015-7371. CWE: CWE-264. CVSS: 5.0. Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service (resource consumption) via a direct request.
Query: vulnerability: The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a cr
Matching passage: CVE-2015-1606. CWE: CWE-416. CVSS: 5.5. The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.
Near-miss passage: CVE-2015-2515. CWE: CWE-416. CVSS: 9.300000190734863. Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted toolbar object, aka "Toolbar Use After Free Vulnerability."
Query: patch priority for CVE-2015-6302
Matching passage: CVE-2015-6302. CWE: CWE-399. CVSS: 5.0. The RADIUS functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.0(250.0) and 7.0(252.0) allows remote attackers to disconnect arbitrary sessions via crafted Disconnect-Request UDP packets, aka Bug ID CSCuw29419.
Near-miss passage: CVE-2015-6287. CWE: CWE-399. CVSS: 5.0. Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects attempts to disable the Windows Firewall using PowerShell. Logsource: windows / process_creation. Rule: title: Windows Firewall Disabled via PowerShell id: 12f6b752-042d-483e-bf9c-915a6d06ad75 related: - id: 488b44e7-3781-4a71-888d-c95abfacf44d type: similar status: test description: Detects attempts to disable the Windows Firewall using PowerShell references: - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-14 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_args: CommandLine|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: CommandLine|contains: - ' -All ' - Public - Domain - Private condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help. Logsource: windows / file_event. Rule: title: Office Macro File Download id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 related: - id: 91174a41-dc8f-401b-be89-7bfc140612a0 type: similar status: test description: 'Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2025-10-29 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_processes: Image|endswith: - \RuntimeBroker.exe - \outlook.exe - \thunderbird.exe - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe selection_ext: - TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm - TargetFilename|contains: - .docm:Zone - .dotm:Zone - .xlsm:Zone - .xltm:Zone - .potm:Zone - .pptm:Zone condition: all of selection_* falsepositives: - Legitimate macro files downloaded from the internet - Legitimate macro files sent as attachments via emails level: low
Query: exploit The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Matching passage: CVE-2015-9309. CWE: CWE-352. CVSS: 8.800000190734863. The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Near-miss passage: CVE-2015-0807. CWE: CWE-352. CVSS: 6.800000190734863. The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
Query: explain CWE-356
Matching passage: CWE-356 Product UI does not Warn User of Unsafe Actions. The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
Near-miss passage: CWE-665 Improper Initialization. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Query: CVE similar to CVE-2015-9455
Matching passage: CVE-2015-9455. CWE: CWE-352. CVSS: 8.100000381469727. The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Near-miss passage: CVE-2015-4267. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(0.147), and 2.0(0.169) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940.
Query: describe CVE-2015-7106
Matching passage: CVE-2015-7106. CWE: CWE-119. CVSS: 7.199999809265137. The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-6695. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted use of the value attribute, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, and CVE-2015-7622.
Query: patch priority for CVE-2015-3674
Matching passage: CVE-2015-3674. CWE: CWE-119. CVSS: 7.5. afpserver in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Near-miss passage: CVE-2015-5871. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5872, CVE-2015-5873, and CVE-2015-5890.
Query: detection rule: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compre
Matching passage: Sigma rule: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compre. Logsource: windows / process_creation. Rule: title: Rar Usage with Password and Compression Level id: faa48cae-6b25-4f00-a094-08947fef582f status: test description: Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions. references: - https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/ - https://ss64.com/bash/rar.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: '@ROxPinTeddy' date: 2020-05-12 modified: 2022-03-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_password: CommandLine|contains: ' -hp' selection_other: CommandLine|contains: - ' -m' - ' a ' condition: selection_password and selection_other falsepositives: - Legitimate use of Winrar command line version - Other command line tools, that use these flags level: high
Near-miss passage: Sigma rule: Identifies when DNS zone is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure DNS Zone Modified or Deleted id: af6925b0-8826-47f1-9324-337507a0babd status: test description: Identifies when DNS zone is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact - attack.t1565.001 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: MICROSOFT.NETWORK/DNSZONES operationName|endswith: - /WRITE - /DELETE condition: selection falsepositives: - DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: secure coding against Asymmetric Resource Consumption (Amplification)
Matching passage: CWE-405 Asymmetric Resource Consumption (Amplification). The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is asymmetric.
Near-miss passage: CWE-697 Incorrect Comparison. The product compares two entities in a security-relevant context, but the comparison is incorrect.
Query: rule covering Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use
Matching passage: Sigma rule: Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use. Logsource: windows / file_event. Rule: title: Self Extraction Directive File Created In Potentially Suspicious Location id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f related: - id: ab90dab8-c7da-4010-9193-563528cfa347 type: derived status: test description: 'Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. ' references: - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html - https://en.wikipedia.org/wiki/IExpress - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-02-05 tags: - attack.stealth - attack.t1218 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - :\ProgramData\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ TargetFilename|endswith: .sed condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious ways to run Invoke-Execution using IEX alias. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell IEX Execution Patterns id: 09576804-7a05-458e-a817-eb718ca91f54 status: test description: Detects suspicious ways to run Invoke-Execution using IEX alias references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2 - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-03-24 modified: 2022-11-28 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_combined_1: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' | iex;' - ' | iex ' - ' | iex}' - ' | IEX ;' - ' | IEX -Error' - ' | IEX (new' - ');IEX ' selection_combined_2: CommandLine|contains: - ::FromBase64String - '.GetString([System.Convert]::' selection_standalone: CommandLine|contains: - )|iex;$ - );iex($ - );iex $ - ' | IEX | ' - ' | iex\"' condition: all of selection_combined_* or selection_standalone falsepositives: - Legitimate scripts that use IEX level: high