alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: telemetry for T1569.002
Matching passage: T1569.002 Service Execution. Tactics: execution. Description: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039). [PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Wind. Logsource: windows / ps_script. Rule: title: Potential Invoke-Mimikatz PowerShell Script id: 189e3b02-82b2-4b90-9662-411eb64486d4 status: test description: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. references: - https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script author: Tim Rauch, Elastic (idea) date: 2022-09-28 tags: - attack.credential-access - attack.t1003 logsource: category: ps_script product: windows detection: selection_1: ScriptBlockText|contains|all: - DumpCreds - DumpCerts selection_2: ScriptBlockText|contains: sekurlsa::logonpasswords selection_3: ScriptBlockText|contains|all: - crypto::certificates - CERT_SYSTEM_STORE_LOCAL_MACHINE condition: 1 of selection* falsepositives: - Mimikatz can be useful for testing the security of networks level: high
Near-miss passage: Sigma rule: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.. Logsource: azure / auditlogs. Rule: title: PIM Approvals And Deny Elevation id: 039a7469-0296-4450-84c0-f6966b16dc6d status: test description: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Request Approved/Denied condition: selection falsepositives: - Actual admin using PIM. level: high
Query: Sigma rule for Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "
Matching passage: Sigma rule: Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow ". Logsource: windows / process_creation. Rule: title: Remote File Download Via Findstr.EXE id: 587254ee-a24b-4335-b3cd-065c0f1f4baa related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_download_1: CommandLine|contains|windash: ' -v ' selection_cli_download_2: CommandLine|contains|windash: ' -l ' selection_cli_download_3: CommandLine|contains: \\\\ condition: selection_findstr and all of selection_cli_download_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate D. Logsource: windows / image_load. Rule: title: System Control Panel Item Loaded From Uncommon Location id: 2b140a5c-dc02-4bb8-b6b1-8bdb45714cde status: test description: 'Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques. ' references: - https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ - https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/ - https://github.com/mhaskar/FsquirtCPLPoC - https://securelist.com/sidewinder-apt/114089/ author: Anish Bogati date: 2024-01-09 modified: 2026-02-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \appwiz.cpl - \bthprops.cpl - \hdwwiz.cpl filter_main_legit_location: ImageLoaded|startswith: - C:\Windows\Prefetch\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location/info.yml
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 410/12, SD 617, SD 650/52, SD 800, and SD 810, if Widevine App TZ_WV_CMD_DECRY
Matching passage: CVE-2015-9133. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 410/12, SD 617, SD 650/52, SD 800, and SD 810, if Widevine App TZ_WV_CMD_DECRYPT_VIDEO is called with a size too large, an integer overflow may occur.
Near-miss passage: CVE-2015-9201. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, integer overflow in tzbsp can lead to privilege escalation.
Query: exploit Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via 
Matching passage: CVE-2015-2067. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Near-miss passage: CVE-2015-4415. CWE: CWE-22. CVSS: 5.0. Multiple directory traversal vulnerabilities in func.php in Magnifica Webscripts Anima Gallery 2.6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) theme or (2) lang cookie parameter to AnimaGallery/.
Query: risk of MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving erro
Matching passage: CVE-2015-8977. CWE: CWE-532. CVSS: 7.5. MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
Near-miss passage: CVE-2015-3243. CWE: CWE-532. CVSS: 5.5. rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron.
Query: write Sigma for Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing
Matching passage: Sigma rule: Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing. Logsource: windows / process_creation. Rule: title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename id: 129966c9-de17-4334-a123-8b58172e664d status: test description: 'Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage. ' references: - https://twitter.com/mrd0x/status/1460597833917251595 author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-26 modified: 2024-06-21 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_dump: Image|startswith: :\Program Files Image|contains: \Microsoft Visual Studio\ Image|endswith: \dump64.exe selection_tools_procdump: - OriginalFileName: procdump - CommandLine|contains: - ' -ma ' - ' -mp ' condition: selection_dump and 1 of selection_tools_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of AdvancedRun utility. Logsource: windows / process_creation. Rule: title: PUA - AdvancedRun Execution id: d2b749ee-4225-417e-b20e-a8d2193cbb84 related: - id: fa00b701-44c6-4679-994d-5a18afa8a707 type: similar status: test description: Detects the execution of AdvancedRun utility references: - https://twitter.com/splinter_code/status/1483815103279603714 - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - https://www.elastic.co/security-labs/operation-bleeding-bear - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-20 modified: 2023-02-21 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1564.003 - attack.t1134.002 - attack.t1059.003 logsource: product: windows category: process_creation detection: selection: - OriginalFileName: AdvancedRun.exe - CommandLine|contains|all: - ' /EXEFilename ' - ' /Run' - CommandLine|contains|all: - ' /WindowState 0' - ' /RunAs ' - ' /CommandLine ' condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml
Query: CVE similar to CVE-2015-7453
Matching passage: CVE-2015-7453. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Quality Manager (RQM) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Team Concert (RTC) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Requirements Composer (RRC) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1 and 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, and 4.0.7 before iFix10, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; and Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108296.
Near-miss passage: CVE-2015-3935. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Query: CVE similar to CVE-2015-3746
Matching passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-0114. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1.
Query: playbook for alert: SIEM correlation: persistence activity consistent with Re-opened Applications
Matching passage: Playbook for T1547.007 Re-opened Applications. 1) Validate alert telemetry against T1547.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named <code>com.apple.l
Near-miss passage: Playbook for T1547.009 Shortcut Modification. Different response path focused on persistence, privilege escalation.
Query: vulnerability: media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow)
Matching passage: CVE-2015-1530. CWE: CWE-190. CVSS: 7.800000190734863. media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow) via a crafted application that provides an invalid array size.
Near-miss passage: CVE-2015-8983. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
Query: patch priority for CVE-2015-3686
Matching passage: CVE-2015-3686. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
Near-miss passage: CVE-2015-3135. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.
Query: rule covering Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio
Matching passage: Sigma rule: Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detectio. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Events Deleted id: 3132570d-cab2-4561-9ea6-1743644b2290 related: - id: 225d8b09-e714-479c-a0e4-55e6f29adf35 type: derived status: test description: 'Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1070 logsource: category: application product: kubernetes service: audit detection: selection: verb: delete objectRef.resource: events condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning. Logsource: windows / process_creation. Rule: title: Potential AMSI Bypass Via .NET Reflection id: 30edb182-aa75-42c0-b0a9-e998bb29067c related: - id: 4f927692-68b5-4267-871b-073c45f4f6fe type: obsolete status: test description: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning references: - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/ - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ author: Markus Neis, @Kostastsale date: 2018-08-17 modified: 2023-02-03 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains|all: - System.Management.Automation.AmsiUtils - amsiInitFailed - CommandLine|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-5552
Matching passage: CVE-2015-5552. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, and CVE-2015-5553.
Near-miss passage: CVE-2015-3742. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: Sigma rule for Detects possible suspicious glue development endpoint activity.
Matching passage: Sigma rule: Detects possible suspicious glue development endpoint activity.. Logsource: aws / cloudtrail. Rule: title: AWS Glue Development Endpoint Activity id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26 status: test description: Detects possible suspicious glue development endpoint activity. references: - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html author: Austin Songer @austinsonger date: 2021-10-03 modified: 2022-12-18 tags: - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: glue.amazonaws.com eventName: - CreateDevEndpoint - DeleteDevEndpoint - UpdateDevEndpoint condition: selection falsepositives: - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects potential installation or installation attempts of known malicious appx packages. Logsource: windows / appxdeployment-server. Rule: title: Potential Malicious AppX Package Installation Attempts id: 09d3b48b-be17-47f5-bf4e-94e7e75d09ce status: test description: Detects potential installation or installation attempts of known malicious appx packages references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ - https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-01-12 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: - 400 - 401 PackageFullName|contains: 3669e262-ec02-4e9d-bcb4-3d008b4afac9 condition: selection falsepositives: - Rare occasions where a malicious package uses the exact same name and version as a legitimate application. level: medium