alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-6065. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6078.
Near-miss passage: CVE-2015-0309. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0304.
Query: risk of Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B2
Matching passage: CVE-2015-8319. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.
Near-miss passage: CVE-2015-1948. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Query: vulnerability: Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-6066. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, CVE-2015-6076, and CVE-2015-6087.
Near-miss passage: CVE-2015-7008. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects powershell scripts that import modules from suspicious directories. Logsource: windows / ps_script. Rule: title: Import PowerShell Modules From Suspicious Directories id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab related: - id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3 type: similar status: test description: Detects powershell scripts that import modules from suspicious directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-07 modified: 2023-01-10 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Import-Module "$Env:Temp\ - Import-Module '$Env:Temp\ - Import-Module $Env:Temp\ - Import-Module "$Env:Appdata\ - Import-Module '$Env:Appdata\ - Import-Module $Env:Appdata\ - Import-Module C:\Users\Public\ - ipmo "$Env:Temp\ - ipmo '$Env:Temp\ - ipmo $Env:Temp\ - ipmo "$Env:Appdata\ - ipmo '$Env:Appdata\ - ipmo $Env:Appdata\ - ipmo C:\Users\Public\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script. Logsource: windows / process_creation. Rule: title: HackTool - Wmiexec Default Powershell Command id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0 status: test description: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script references: - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-08 tags: - attack.lateral-movement - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc condition: selection falsepositives: - Unlikely level: high
Query: exploit lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect p
Matching passage: CVE-2015-2696. CWE: CWE-18. CVSS: 7.099999904632568. lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.
Near-miss passage: CVE-2015-7262. CWE: CWE-18. CVSS: 7.5. QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot.
Query: exploit The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake stat
Matching passage: CVE-2015-2318. CWE: CWE-295. CVSS: 8.100000381469727. The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
Near-miss passage: CVE-2015-4094. CWE: CWE-295. CVSS: 5.800000190734863. The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: alert when Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is try
Matching passage: Sigma rule: Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is try. Logsource: windows / file_event. Rule: title: PDF File Created By RegEdit.EXE id: 145095eb-e273-443b-83d0-f9b519b7867b status: test description: 'Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses. ' references: - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: \regedit.exe TargetFilename|endswith: .pdf condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's locat. Logsource: windows / process_creation. Rule: title: Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 236d8e89-ed95-4789-a982-36f4643738ba related: - id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_bin_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_bin_cli: CommandLine|contains|all: - ' script ' - ' set ' selection_susp_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-0036. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0041.
Near-miss passage: CVE-2015-2778. CWE: CWE-399. CVSS: 5.0. Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Query: how to detect Ccache Files
Matching passage: T1558.005 Ccache Files. Tactics: credential access. Description: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The <code>/etc/krb5.conf</code> configuration file and the <code>KRB5CCNAME</code> environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using <code>kinit</code>, which obtains a Ticket-Granting-Ticket (TGT) for the principal; <code>klist</code>, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux) Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Near-miss passage: T1558.002 Silver Ticket. Tactics: credential access. Description: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).
Query: exploit An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750.
Matching passage: CVE-2015-9014. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750.
Near-miss passage: CVE-2015-2694. CWE: CWE-264. CVSS: 5.800000190734863. The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
Query: write Sigma for Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
Matching passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. Logsource: rpc_firewall / application. Rule: title: Remote Encrypting File System Abuse id: 5f92fff9-82e2-48eb-8fc1-8b133556a551 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - df1941c5-fe89-4e79-bf10-463657acf44d - c681d488-d850-11d0-8c52-00c04fd90f7e condition: selection falsepositives: - Legitimate usage of remote file encryption level: high
Near-miss passage: Sigma rule: Detects registry modifications that disable Privacy Settings Experience. Logsource: windows / registry_set. Rule: title: Disable Privacy Settings Experience in Registry id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b status: test description: Detects registry modifications that disable Privacy Settings Experience references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md author: frack113 date: 2022-10-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate admin script level: medium
Query: write Sigma for Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Matching passage: Sigma rule: Detects MsiExec loading a DLL and calling its DllUnregisterServer function. Logsource: windows / process_creation. Rule: title: DllUnregisterServer Function Call Via Msiexec.EXE id: 84f52741-8834-4a8c-a413-2eb2269aa6c8 status: test description: Detects MsiExec loading a DLL and calling its DllUnregisterServer function references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/ - https://twitter.com/_st0pp3r_/status/1583914515996897281 author: frack113 date: 2022-04-24 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.007 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: \msiexec.exe selection_flag: CommandLine|contains|windash: ' -z ' selection_dll: CommandLine|contains: .dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / process_creation. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled id: 55f0a3a1-846e-40eb-8273-677371b8d912 related: - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) date: 2018-12-27 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: \Outlook\Security\EnableUnsafeClientMailRules condition: selection falsepositives: - Unknown level: high
Query: alert when Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut
Matching passage: Sigma rule: Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut. Logsource: windows / process_creation. Rule: title: Use of FSharp Interpreters id: b96b2031-7c17-4473-afe7-a30ce714db29 status: test description: 'Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 modified: 2024-04-23 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \fsi.exe - \fsianycpu.exe - OriginalFileName: - fsi.exe - fsianycpu.exe condition: selection falsepositives: - Legitimate use by a software developer. level: medium
Near-miss passage: Sigma rule: Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell scrip. Logsource: windows / process_creation. Rule: title: Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 id: 1e0e1a81-e79b-44bc-935b-ddb9c8006b3d status: test description: Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands references: - https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/ author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113 date: 2022-05-21 modified: 2023-08-17 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_pwsh: ParentImage|endswith: - \powershell.exe - \pwsh.exe Image|endswith: \powershell.exe CommandLine|contains: ' -nologo -windowstyle minimized -file ' selection_temp: CommandLine|contains: - \AppData\Local\Temp\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unknown level: medium
Query: detect Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities in logs
Matching passage: Sigma rule: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities. Logsource: windows / ps_script. Rule: title: Potential AMSI Bypass Script Using NULL Bits id: fa2559c8-1197-471d-9cdd-05a0273d4522 related: - id: 92a974db-ab84-457f-9ec0-55db83d7a825 type: similar status: test description: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities references: - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 modified: 2023-05-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - if(0){{{0}}}' -f $(0 -as [char]) + - '#<NULL>' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious pare. Logsource: windows / process_creation. Rule: title: Suspicious WMIC Execution Via Office Process id: e1693bc8-7168-4eab-8718-cdcaa68a1738 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0 type: obsolete - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5 type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin). references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov, Cyb3rEng date: 2021-08-23 modified: 2023-02-14 tags: - attack.stealth - attack.t1204.002 - attack.t1047 - attack.t1218.010 - attack.execution logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.EXE - \EQNEDT32.EXE - \ONENOTE.EXE - \wordpad.exe - \wordview.exe selection_wmic_img: - Image|endswith: \wbem\WMIC.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains|all: - process - create - call CommandLine|contains: - regsvr32 - rundll32 - msiexec - mshta - verclsid - wscript - cscript condition: all of selection_* falsepositives: - Unknown level: high