alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: hunt for Python activity
Matching passage: T1059.006 Python. Tactics: execution. Description: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Near-miss passage: T1059.013 Container CLI/API. Tactics: execution. Description: Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.(Citation: Docker Desktop CLI) Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Build Image on Host](https://attack.mitre.org/techniques/T1612)), run containers (i.e., [Deploy Container](https://attack.mitre.org/techniques/T1610)), or execute commands inside running containers (i.e., [Container Administration Command](https://attack.mitre.org/techniques/T1609)). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the `curl` command to download payloads.(Citation: Intezer) Adversaries may also utilize `docker inspect` and `docker ps` to scan for cloud environment variables and other running containers (i.e., [Container and Resource Discovery](https://attack.mitre.org/techniques/T1613)).(Citation: Cisco Talos Blog)(Citation: aquasec) Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as `kubectl`. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via `curl` o
Query: rule covering Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be instal
Matching passage: Sigma rule: Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be instal. Logsource: linux / process_creation. Rule: title: Clipboard Collection with Xclip Tool id: ec127035-a636-4b9a-8555-0efd4e59f316 status: test description: 'Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://www.packetlabs.net/posts/clipboard-data-security/ author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-09-15 tags: - attack.collection - attack.t1115 logsource: product: linux category: process_creation detection: selection: Image|contains: xclip CommandLine|contains|all: - -sel - clip - -o condition: selection falsepositives: - Legitimate usage of xclip tools. level: low
Near-miss passage: Sigma rule: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default loc. Logsource: windows / process_creation. Rule: title: Wab Execution From Non Default Location id: 395907ee-96e5-4666-af2e-2ca91688e151 status: test description: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \wab.exe - \wabmig.exe filter: Image|startswith: - C:\Windows\WinSxS\ - C:\Program Files\Windows Mail\ - C:\Program Files (x86)\Windows Mail\ condition: selection and not filter falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6355
Matching passage: CVE-2015-6355. CWE: CWE-200. CVSS: 5.0. The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive version information by visiting an unspecified URL, aka Bug ID CSCuw87226.
Near-miss passage: CVE-2015-7827. CWE: CWE-200. CVSS: 7.5. Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
Query: secure coding against Executable Regular Expression Error
Matching passage: CWE-624 Executable Regular Expression Error. The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
Near-miss passage: CWE-1044 Architecture with Number of Horizontal Layers Outside of Expected Range. The product's architecture contains too many - or too few - horizontal layers.
Query: describe CVE-2015-5362
Matching passage: CVE-2015-5362. CWE: CWE-399. CVSS: 9.300000190734863. The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D85, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10 allows remote attackers to cause a denial of service (bfdd crash and restart) or execute arbitrary code via a crafted BFD packet.
Near-miss passage: CVE-2015-2340. CWE: CWE-399. CVSS: 6.099999904632568. TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors.
Query: exploit The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspec
Matching passage: CVE-2015-4308. CWE: CWE-200. CVSS: 6.800000190734863. The webGUI configuration-export feature in Cisco Edge Bluebird Operating System 1.2 on Edge 340 devices allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuu43968.
Near-miss passage: CVE-2015-0583. CWE: CWE-200. CVSS: 5.0. Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281.
Query: rule covering Detects potentially suspicious file downloads directly from IP addresses using curl.exe
Matching passage: Sigma rule: Detects potentially suspicious file downloads directly from IP addresses using curl.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From IP Via Curl.EXE id: 5cb299fc-5fb1-4d07-b989-0644c68b6043 status: test description: Detects potentially suspicious file downloads directly from IP addresses using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output selection_ext: CommandLine|endswith: - .bat - .bat" - .dat - .dat" - .dll - .dll" - .exe - .exe" - .gif - .gif" - .hta - .hta" - .jpeg - .jpeg" - .log - .log" - .msi - .msi" - .png - .png" - .ps1 - .ps1" - .psm1 - .psm1" - .vbe - .vbe" - .vbs - .vbs" - .bat' - .dat' - .dll' - .exe' - .gif' - .hta' - .jpeg' - .log' - .msi' - .png' - .ps1' - .psm1' - .vbe' - .vbs' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions/info.yml
Near-miss passage: Sigma rule: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Powershell Search Order Hijacking - Task id: b66474aa-bd92-4333-a16c-298155b120df related: - id: 6e8811ee-90ba-441e-8486-5653e68b2299 type: similar status: test description: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader references: - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-04-08 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage: C:\WINDOWS\System32\svchost.exe ParentCommandLine|contains|all: - -k netsvcs - -s Schedule CommandLine|endswith: - ' -windowstyle hidden' - ' -w hidden' - ' -ep bypass' - ' -noni' condition: selection falsepositives: - Unknown level: high
Query: detection rule: Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the
Matching passage: Sigma rule: Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the. Logsource: windows / process_creation. Rule: title: Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths id: c74c0390-3e20-41fd-a69a-128f0275a5ea related: - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9 type: derived status: test description: 'Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths. ' references: - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://www.echotrail.io/insights/search/wusa.exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-11-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_root: Image|endswith: \wusa.exe CommandLine|contains: '/extract:' selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution With Local RDP File id: 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock date: 2023-04-18 modified: 2023-04-30 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|endswith: - .rdp - .rdp" filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Likely with legitimate usage of ".rdp" files level: low
Query: describe CVE-2015-9137
Matching passage: CVE-2015-9137. CWE: CWE-19. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, several EFS2 DIAG command handlers are not calling fs_diag_access_check().
Near-miss passage: CVE-2015-0854. CWE: CWE-19. CVSS: 7.800000190734863. App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action.
Query: describe CVE-2015-5812
Matching passage: CVE-2015-5812. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-4144. CWE: CWE-119. CVSS: 5.0. The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.
Query: Sigma rule for Download or Copy file with Extrac32
Matching passage: Sigma rule: Download or Copy file with Extrac32. Logsource: windows / process_creation. Rule: title: Suspicious Extrac32 Execution id: aa8e035d-7be4-48d3-a944-102aec04400d status: test description: Download or Copy file with Extrac32 references: - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_lolbas: - CommandLine|contains: extrac32.exe - Image|endswith: \extrac32.exe - OriginalFileName: extrac32.exe selection_archive: CommandLine|contains: .cab selection_options: CommandLine|contains: - /C - /Y - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using Event Viewer RecentViews. Logsource: windows / process_creation. Rule: title: UAC Bypass Using Event Viewer RecentViews id: 30fc8de7-d833-40c4-96b6-28319fbc4f6c related: - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43 type: similar status: test description: Detects the pattern of UAC Bypass using Event Viewer RecentViews references: - https://twitter.com/orange_8361/status/1518970259868626944 - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-22 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection_path: CommandLine|contains: - \Event Viewer\RecentViews - \EventV~1\RecentViews selection_redirect: CommandLine|contains: '>' condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, int
Matching passage: CVE-2015-4785. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-4879. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.
Query: indicators of External Defacement
Matching passage: T1491.002 External Defacement. Tactics: impact. Description: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages. Logsource: windows / ps_script. Rule: title: Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript id: 975b2262-9a49-439d-92a6-0709cccdf0b2 related: - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a type: similar - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af type: similar status: test description: Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages references: - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package - https://twitter.com/WindowsDocs/status/1620078135080325122 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-31 tags: - attack.persistence - attack.stealth logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection_cmdlet: ScriptBlockText|contains: - 'Add-AppPackage ' - 'Add-AppxPackage ' selection_flag: ScriptBlockText|contains: ' -AllowUnsigned' condition: all of selection_* falsepositives: - Installation of unsigned packages for testing purposes level: medium
Near-miss passage: Sigma rule: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host. Logsource: windows / security. Rule: title: WCE wceaux.dll Access id: 1de68c67-af5c-4097-9c85-fe5578e09e67 status: test description: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-14 modified: 2025-01-30 tags: - attack.credential-access - attack.t1003 - attack.s0005 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectName|endswith: \wceaux.dll condition: selection falsepositives: - Unknown level: critical
Query: CVE similar to CVE-2015-9242
Matching passage: CVE-2015-9242. CWE: CWE-400. CVSS: 7.5. Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Near-miss passage: CVE-2015-7978. CWE: CWE-400. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
Query: patch priority for CVE-2015-9176
Matching passage: CVE-2015-9176. CWE: CWE-119. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, Input_address is registered as a shared buffer and is not properly checked before use in OEMCrypto_Generic_Sign(). This allows addresses to be accessed that reside in secure/CP memory.
Near-miss passage: CVE-2015-3056. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.