alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects execution of renamed version of PAExec. Often used by attackers
Matching passage: Sigma rule: Detects execution of renamed version of PAExec. Often used by attackers. Logsource: windows / process_creation. Rule: title: Renamed PAExec Execution id: c4e49831-1496-40cf-8ce1-b53f942b02f9 related: - id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b type: obsolete status: test description: Detects execution of renamed version of PAExec. Often used by attackers references: - https://www.poweradmin.com/paexec/ - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf author: Florian Roth (Nextron Systems), Jason Lynch date: 2021-05-22 modified: 2024-11-23 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: - Description: PAExec Application - OriginalFileName: PAExec.exe - Product|contains: PAExec - Hashes|contains: - IMPHASH=11D40A7B7876288F919AB819CC2D9802 - IMPHASH=6444f8a34e99b8f7d9647de66aabe516 - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c filter_main_known_location: - Image|endswith: \paexec.exe - Image|startswith: C:\Windows\PAExec- condition: selection and not 1 of filter_main_* falsepositives: - Weird admins that rename their tools - Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing - When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]" level: high
Near-miss passage: Sigma rule: Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths. Logsource: windows / process_creation. Rule: title: Suspicious New Service Creation id: 17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8 related: - id: 7fe71fc9-de3b-432a-8d57-8c809efc10ab type: derived status: test description: Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-14 modified: 2022-11-18 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: Image|endswith: \sc.exe CommandLine|contains|all: - create - binPath= selection_posh: CommandLine|contains|all: - New-Service - -BinaryPathName susp_binpath: CommandLine|contains: - powershell - mshta - wscript - cscript - svchost - dllhost - 'cmd ' - cmd.exe /c - cmd.exe /k - cmd.exe /r - rundll32 - C:\Users\Public - \Downloads\ - \Desktop\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - C:\Windows\TEMP\ - \AppData\Local\Temp condition: 1 of selection* and susp_binpath falsepositives: - Unlikely level: high
Query: alert when Detects potential DLL sideloading of "SolidPDFCreator.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "SolidPDFCreator.dll". Logsource: windows / image_load. Rule: title: Potential SolidPDFCreator.DLL Sideloading id: a2edbce1-95c8-4291-8676-0d45146862b3 status: test description: Detects potential DLL sideloading of "SolidPDFCreator.dll" references: - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/ author: X__Junior (Nextron Systems) date: 2023-05-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \SolidPDFCreator.dll filter_main_path: Image|endswith: \SolidPDFCreator.exe ImageLoaded|startswith: - C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\ - C:\Program Files\SolidDocuments\SolidPDFCreator\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Type With High Privileges id: 7a02e22e-b885-4404-b38b-1ddc7e65258a related: - id: 24c8392b-aa3c-46b7-a545-43f71657fe98 type: similar status: test description: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' selection_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* falsepositives: - Some installers were seen using this method of creation unfortunately. Filter them in your environment level: medium
Query: common weakness: Missing Synchronization
Matching passage: CWE-820 Missing Synchronization. The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
Near-miss passage: CWE-1392 Use of Default Credentials. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Query: Lateral movement indicators for Data Staged
Matching passage: T1074 Data Staged. Tactics: collection. Description: Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017) In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
Near-miss passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Query: write Sigma for Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certi
Matching passage: Sigma rule: Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certi. Logsource: windows / certificateservicesclient-lifecycle-system. Rule: title: Certificate Exported From Local Certificate Store id: 58c0bff0-40a0-46e8-b5e8-b734b84d2017 status: test description: Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. references: - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Zach Mathis date: 2023-05-13 tags: - attack.credential-access - attack.t1649 logsource: product: windows service: certificateservicesclient-lifecycle-system detection: selection: EventID: 1007 condition: selection falsepositives: - Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed level: medium
Near-miss passage: Sigma rule: Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help. Logsource: windows / file_event. Rule: title: Office Macro File Download id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 related: - id: 91174a41-dc8f-401b-be89-7bfc140612a0 type: similar status: test description: 'Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2025-10-29 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_processes: Image|endswith: - \RuntimeBroker.exe - \outlook.exe - \thunderbird.exe - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe selection_ext: - TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm - TargetFilename|contains: - .docm:Zone - .dotm:Zone - .xlsm:Zone - .xltm:Zone - .potm:Zone - .pptm:Zone condition: all of selection_* falsepositives: - Legitimate macro files downloaded from the internet - Legitimate macro files sent as attachments via emails level: low
Query: exploit Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Matching passage: CVE-2015-4135. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in goto.php in phpwind 8.7 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Near-miss passage: CVE-2015-10120. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
Query: CVE similar to CVE-2015-0016
Matching passage: CVE-2015-0016. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4085. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects a typical pattern of a CobaltStrike BOF which inject into other processes. Logsource: windows / process_access. Rule: title: HackTool - CobaltStrike BOF Injection Pattern id: 09706624-b7f6-455d-9d02-adee024cee1d status: test description: Detects a typical pattern of a CobaltStrike BOF which inject into other processes references: - https://github.com/boku7/injectAmsiBypass - https://github.com/boku7/spawn author: Christian Burkard (Nextron Systems) date: 2021-08-04 modified: 2023-11-28 tags: - attack.execution - attack.defense-impairment - attack.t1106 - attack.t1685 logsource: category: process_access product: windows detection: selection: CallTrace|re: ^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\|C:\\Windows\\System32\\KERNELBASE\.dll\+[a-z0-9]{4,6}\|UNKNOWN\([A-Z0-9]{16}\)$ GrantedAccess: - '0x1028' - '0x1fffff' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of DeviceCredentialDeployment to hide a process from view.. Logsource: windows / process_creation. Rule: title: DeviceCredentialDeployment Execution id: b8b1b304-a60f-4999-9a6e-c547bde03ffd status: test description: 'Detects the execution of DeviceCredentialDeployment to hide a process from view. ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/147 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \DeviceCredentialDeployment.exe condition: selection falsepositives: - Unlikely level: medium
Query: SOC runbook when seeing Suspicious Serverless execution detected on endpoint
Matching passage: Playbook for T1583.007 Serverless. 1) Validate alert telemetry against T1583.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to eithe
Near-miss passage: Playbook for T1583.004 Server. Different response path focused on resource development.
Query: rule covering Detects suspicious parent processes that should not have any children or should only have a single possible child progra
Matching passage: Sigma rule: Detects suspicious parent processes that should not have any children or should only have a single possible child progra. Logsource: windows / process_creation. Rule: title: Suspicious Process Parents id: cbec226f-63d9-4eca-9f52-dfb6652f24df status: test description: Detects suspicious parent processes that should not have any children or should only have a single possible child program references: - https://twitter.com/x86matthew/status/1505476263464607744?s=12 - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2022-09-08 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \minesweeper.exe - \winver.exe - \bitsadmin.exe selection_special: ParentImage|endswith: - \csrss.exe - \certutil.exe - \eventvwr.exe - \calc.exe - \notepad.exe filter_special: Image|endswith: - \WerFault.exe - \wermgr.exe - \conhost.exe - \mmc.exe - \win32calc.exe - \notepad.exe filter_null: Image: null condition: selection or ( selection_special and not 1 of filter_* ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s. Logsource: windows / registry_set. Rule: title: ClickOnce Trust Prompt Tampering id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb status: test description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)' date: 2023-06-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\ TargetObject|endswith: - \Internet - \LocalIntranet - \MyComputer - \TrustedSites - \UntrustedSites Details: Enabled condition: selection falsepositives: - Legitimate internal requirements. level: medium
Query: telemetry for T1567.004
Matching passage: T1567.004 Exfiltration Over Webhook. Tactics: exfiltration. Description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server) Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
Near-miss passage: T1567 Exfiltration Over Web Service. Tactics: exfiltration. Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: describe CVE-2015-1812
Matching passage: CVE-2015-1812. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
Near-miss passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.
Query: stealth using Stripped Payloads
Matching passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Near-miss passage: T1027.007 Dynamic API Resolution. Tactics: stealth. Description: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by malware may leave static artifacts such as strings in payload files. Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing) To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. Various methods may be used to obfuscate malware calls to API functions. For example, hashes of function names are commonly stored in malware in lieu of literal strings. Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)