alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.
Matching passage: Sigma rule: Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.. Logsource: windows / process_creation. Rule: title: UtilityFunctions.ps1 Proxy Dll id: 0403d67d-6227-4ea8-8145-4e72db7da120 status: test description: Detects the use of a Microsoft signed script executing a managed DLL with PowerShell. references: - https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/ author: frack113 date: 2022-05-28 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - UtilityFunctions.ps1 - 'RegSnapin ' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Windows executables that write files with suspicious extensions. Logsource: windows / file_event. Rule: title: Windows Binaries Write Suspicious Extensions id: b8fd0e93-ff58-4cbd-8f48-1c114e342e62 related: - id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43 type: derived status: test description: Detects Windows executables that write files with suspicious extensions references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2025-10-07 tags: - attack.stealth - attack.t1036 logsource: category: file_event product: windows detection: selection_generic: Image|endswith: - \csrss.exe - \lsass.exe - \RuntimeBroker.exe - \sihost.exe - \smss.exe - \wininit.exe - \winlogon.exe TargetFilename|endswith: - .bat - .dll - .exe - .hta - .iso - .ps1 - .txt - .vbe - .vbs selection_special: Image|endswith: - \dllhost.exe - \rundll32.exe - \svchost.exe TargetFilename|endswith: - .bat - .hta - .iso - .ps1 - .vbe - .vbs filter_main_AppLockerPolicyTest: Image: C:\Windows\System32\dllhost.exe TargetFilename|contains|all: - :\Users\ - \AppData\Local\Temp\__PSScriptPolicyTest_ TargetFilename|endswith: .ps1 filter_main_script_gpo_machine: Image: C:\Windows\system32\svchost.exe TargetFilename|contains|all: - C:\Windows\System32\GroupPolicy\DataStore\ - \sysvol\ - \Policies\ - \Machine\Scripts\Startup\ TargetFilename|endswith: - .ps1 - .bat filter_main_clipchamp: Image: C:\Windows\system32\svchost.exe TargetFilename|contains|all: - C:\Program Files\WindowsApps\Clipchamp - .ps1 filter_main_powershell_preview: Image: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|startswith: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - C:\Program Files (x86)\WindowsApps\Microsoft.PowerShellPreview TargetFilename|endswith: .ps1 condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: alert when Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Matching passage: Sigma rule: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Created In KeePass.EXE id: 77564cc2-7382-438b-a7f6-395c2ae53b9a status: test description: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity references: - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a - https://github.com/denandz/KeeFarce - https://github.com/GhostPack/KeeThief author: Timon Hackenjos date: 2022-04-22 modified: 2023-05-05 tags: - attack.credential-access - attack.t1555.005 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \KeePass.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde. Logsource: windows / registry_set. Rule: title: Suspicious Application Allowed Through Exploit Guard id: 42205c73-75c8-4a63-9db1-e3782e06fda0 status: test description: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications selection_paths: TargetObject|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unlikely level: high
Query: SOC runbook when seeing Persistence mechanism resembling vSphere Installation Bundles
Matching passage: Playbook for T1505.006 vSphere Installation Bundles. 1) Validate alert telemetry against T1505.006. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot. Howe
Near-miss passage: Playbook for T1505.004 IIS Components. Different response path focused on persistence.
Query: describe CVE-2015-5087
Matching passage: CVE-2015-5087. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Near-miss passage: CVE-2015-7696. CWE: CWE-119. CVSS: 6.800000190734863. Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.
Query: telemetry for T1546.005
Matching passage: T1546.005 Trap. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>. Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
Near-miss passage: T1546.009 AppCert DLLs. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code> Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions <code>CreateProcess</code>, <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>, or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
Query: containment actions for Multiple failed authentications followed by Dynamic API Resolution
Matching passage: Playbook for T1027.007 Dynamic API Resolution. 1) Validate alert telemetry against T1027.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by
Near-miss passage: Playbook for T1027.014 Polymorphic Code. Different response path focused on stealth.
Query: exploit PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buf
Matching passage: CVE-2015-8385. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-5794. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: hunt for Multiband Communication activity
Matching passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: CVE similar to CVE-2015-5080
Matching passage: CVE-2015-5080. CWE: CWE-77. CVSS: 9.0. The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs.
Near-miss passage: CVE-2015-0538. CWE: CWE-77. CVSS: 9.300000190734863. ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets.
Query: Outbound C2 pattern associated with Fallback Channels
Matching passage: T1008 Fallback Channels. Tactics: command and control. Description: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
Near-miss passage: T1001.003 Protocol or Service Impersonation. Tactics: command and control. Description: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42)
Query: write Sigma for Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
Matching passage: Sigma rule: Detects potential registry persistence technique using the Event Viewer "Events.asp" technique. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Event Viewer Events.asp id: a1e11042-a74a-46e6-b07c-c4ce8ecc239b status: test description: Detects potential registry persistence technique using the Event Viewer "Events.asp" technique references: - https://twitter.com/nas_bench/status/1626648985824788480 - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks - https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/ - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-17 modified: 2023-03-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgram - \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionURL filter_default_redirect_program: Image|endswith: C:\WINDOWS\system32\svchost.exe TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgram Details: '%%SystemRoot%%\PCHealth\HelpCtr\Binaries\HelpCtr.exe' filter_default_redirect_program_cli: Image|endswith: C:\WINDOWS\system32\svchost.exe TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgramCommandLineParameters Details: -url hcp://services/centers/support?topic=%%s filter_url: Details: http://go.microsoft.com/fwlink/events.asp filter_cleaner: Details: (Empty) condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-8890
Matching passage: CVE-2015-8890. CWE: CWE-264. CVSS: 7.800000190734863. platform/msm_shared/partition_parser.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate certain GUID Partition Table (GPT) data, which allows attackers to bypass intended access restrictions via a crafted MultiMediaCard (MMC), aka Android internal bug 28822878 and Qualcomm internal bug CR823461.
Near-miss passage: CVE-2015-3255. CWE: CWE-264. CVSS: 4.599999904632568. The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.
Query: describe CVE-2015-9421
Matching passage: CVE-2015-9421. CWE: CWE-352. CVSS: 6.5. The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Near-miss passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Query: vulnerability: The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certific
Matching passage: CVE-2015-6999. CWE: CWE-254. CVSS: 5.0. The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate.
Near-miss passage: CVE-2015-7976. CWE: CWE-254. CVSS: 4.300000190734863. The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.
Query: patch priority for CVE-2015-5160
Matching passage: CVE-2015-5160. CWE: CWE-200. CVSS: 5.5. libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
Near-miss passage: CVE-2015-2253. CWE: CWE-200. CVSS: 5.0. The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.
Query: rule covering Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co
Matching passage: Sigma rule: Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Today Page id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 related: - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 type: similar status: test description: 'Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl". ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-10 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains|all: - Software\Microsoft\Office\ - \Outlook\Today\ selection_value_stamp: TargetObject|endswith: \Stamp Details: DWORD (0x00000001) selection_value_url: TargetObject|endswith: - \URL - \UserDefinedUrl filter_main_office: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ Image|endswith: \OfficeClickToRun.exe condition: selection_main and 1 of selection_value_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect change of the user account associated with the FAX service to avoid the escalation problem.. Logsource: windows / registry_set. Rule: title: Change User Account Associated with the FAX Service id: e3fdf743-f05b-4051-990a-b66919be1743 status: test description: Detect change of the user account associated with the FAX service to avoid the escalation problem. references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject: HKLM\System\CurrentControlSet\Services\Fax\ObjectName filter: Details|contains: NetworkService condition: selection and not filter falsepositives: - Unknown level: high