alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and
Matching passage: Sigma rule: Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and. Logsource: windows / process_creation. Rule: title: Potential Suspicious Windows Feature Enabled - ProcCreation id: c740d4cf-a1e9-41de-bb16-8a46a4f57918 related: - id: 55c925c1-7195-426b-a136-a9396800e29b type: similar status: test description: 'Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system - https://learn.microsoft.com/en-us/windows/wsl/install-on-server author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_cmd: CommandLine|contains|all: - Enable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: CommandLine|contains: - TelnetServer - Internet-Explorer-Optional-amd64 - TFTP - SMB1Protocol - Client-ProjFS - Microsoft-Windows-Subsystem-Linux condition: all of selection_* falsepositives: - Legitimate usage of the features listed in the rule. level: medium
Near-miss passage: Sigma rule: Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due t. Logsource: linux / auditd. Rule: title: Screen Capture with Import Tool id: dbe4b9c5-c254-4258-9688-d6af0b7967fd status: test description: 'Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md - https://linux.die.net/man/1/import - https://imagemagick.org/ author: Pawel Mazur date: 2021-09-21 modified: 2022-10-09 tags: - attack.collection - attack.t1113 logsource: product: linux service: auditd detection: import: type: EXECVE a0: import import_window_root: a1: -window a2: root a3|endswith: - .png - .jpg - .jpeg import_no_window_root: a1|endswith: - .png - .jpg - .jpeg condition: import and (import_window_root or import_no_window_root) falsepositives: - Legitimate use of screenshot utility level: low
Query: patch priority for CVE-2015-6373
Matching passage: CVE-2015-6373. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611.
Near-miss passage: CVE-2015-6007. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to hijack the authentication of arbitrary users.
Query: EDR alert: possible Junk Code Insertion (T1027.016)
Matching passage: T1027.016 Junk Code Insertion. Tactics: stealth. Description: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code) No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.(Citation: ReasonLabs) The use of junk / dead code insertion is distinct from [Binary Padding](https://attack.mitre.org/techniques/T1027/001) because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Near-miss passage: T1027.014 Polymorphic Code. Tactics: stealth. Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
Query: describe CVE-2015-4163
Matching passage: CVE-2015-4163. CWE: UNKNOWN. CVSS: 4.900000095367432. GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.
Near-miss passage: CVE-2015-2975. CWE: UNKNOWN. CVSS: 5.0. Research Artisan Lite before 1.18 does not ensure that a user has authenticated, which allows remote attackers to perform unspecified actions via unknown vectors.
Query: secure coding against Struts: Form Bean Does Not Extend Validation Class
Matching passage: CWE-104 Struts: Form Bean Does Not Extend Validation Class. If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
Near-miss passage: CWE-1120 Excessive Code Complexity. The code is too complex, as calculated using a well-defined, quantitative measure.
Query: vulnerability: Unspecified vulnerability in the Oracle VM Server for SPARC component in Oracle Sun Systems Products Suite 3.2 allows remote attackers to affect availability via vectors related to
Matching passage: CVE-2015-4750. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle VM Server for SPARC component in Oracle Sun Systems Products Suite 3.2 allows remote attackers to affect availability via vectors related to LDOM Manager.
Near-miss passage: CVE-2015-2853. CWE: UNKNOWN. CVSS: 6.800000190734863. Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID.
Query: vulnerability: arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows 
Matching passage: CVE-2015-8950. CWE: CWE-200. CVSS: 5.5. arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: exploit MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem lo
Matching passage: CVE-2015-1062. CWE: CWE-19. CVSS: 5.0. MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app.
Near-miss passage: CVE-2015-0621. CWE: CWE-19. CVSS: 7.800000190734863. Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347.
Query: patch priority for CVE-2015-7330
Matching passage: CVE-2015-7330. CWE: CWE-254. CVSS: 8.800000190734863. Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Near-miss passage: CVE-2015-7863. CWE: CWE-254. CVSS: 5.0. The default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
Query: exploit The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50), 9.3(2.100), 9.3(3), and 9.4(1) mishandles cases where an IP
Matching passage: CVE-2015-4321. CWE: CWE-20. CVSS: 5.0. The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50), 9.3(2.100), 9.3(3), and 9.4(1) mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table, which allows remote attackers to bypass uRPF validation via spoofed packets, aka Bug ID CSCuv60724.
Near-miss passage: CVE-2015-8725. CWE: CWE-20. CVSS: 5.5. The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the IPv6 prefix length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files.. Logsource: windows / process_creation. Rule: title: Suspicious Download Via Certutil.EXE id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b related: - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/info.yml
Near-miss passage: Sigma rule: Detects suspicious Powershell code that execute COM Objects. Logsource: windows / ps_script. Rule: title: Suspicious GetTypeFromCLSID ShellExecute id: 8bc063d5-3a3a-4f01-a140-bc15e55e8437 status: test description: Detects suspicious Powershell code that execute COM Objects references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object author: frack113 date: 2022-04-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - ::GetTypeFromCLSID( - .ShellExecute( condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.. Logsource: windows / image_load. Rule: title: Potential Waveedit.DLL Sideloading id: 71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb status: test description: Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software. references: - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html author: X__Junior (Nextron Systems) date: 2023-06-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \waveedit.dll filter_main_legit_path: Image: - C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\waveedit.exe - C:\Program Files\Nero\Nero Apps\Nero WaveEditor\waveedit.exe ImageLoaded|startswith: - C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\ - C:\Program Files\Nero\Nero Apps\Nero WaveEditor\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro. Logsource: windows / network_connection. Rule: title: Communication To LocaltoNet Tunneling Service Initiated id: 3ab65069-d82a-4d44-a759-466661a082d1 status: test description: 'Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls. ' references: - https://localtonet.com/documents/supported-tunnels - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications author: Andreas Braathen (mnemonic.io) date: 2024-06-17 tags: - attack.command-and-control - attack.t1572 - attack.t1090 - attack.t1102 logsource: category: network_connection product: windows detection: selection: DestinationHostname|endswith: - .localto.net - .localtonet.com Initiated: 'true' condition: selection falsepositives: - Legitimate use of the LocaltoNet service. level: high
Query: describe CVE-2015-3633
Matching passage: CVE-2015-3633. CWE: CWE-119. CVSS: 5.0. Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via vectors related to digital signatures.
Near-miss passage: CVE-2015-2820. CWE: CWE-119. CVSS: 5.0. Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.
Query: Sigma rule for Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: PowerShell Console History Logs Deleted id: ff301988-c231-4bd0-834c-ac9d73b86586 status: test description: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|endswith: \PSReadLine\ConsoleHost_history.txt condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects persistence registry keys for Recycle Bin. Logsource: windows / registry_event. Rule: title: Registry Persistence Mechanisms in Recycle Bin id: 277efb8f-60be-4f10-b4d3-037802f37167 status: test description: Detects persistence registry keys for Recycle Bin references: - https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf - https://persistence-info.github.io/Data/recyclebin.html - https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/ author: frack113 date: 2021-11-18 modified: 2022-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection_create: EventType: RenameKey NewName|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open selection_set: EventType: SetValue TargetObject|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command\(Default) condition: 1 of selection_* falsepositives: - Unknown level: high
Query: intelligence brief on T1053.003
Matching passage: T1053.003 Cron. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths. An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)
Near-miss passage: T1053.006 Systemd Timers. Tactics: execution, persistence, privilege escalation. Description: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the <code>systemctl</code> command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control) Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>. An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d)
Query: vulnerability: The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration
Matching passage: CVE-2015-0615. CWE: CWE-19. CVSS: 7.099999904632568. The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions, aka Bug ID CSCul28089.
Near-miss passage: CVE-2015-3990. CWE: CWE-19. CVSS: 9.0. The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.
Query: write Sigma for Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UN
Matching passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UN. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Activity Invoking Sys File id: 731231b9-0b5d-4219-94dd-abb6959aa7ea status: test description: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: rundll32.exe selection2: CommandLine|contains: - .sys, - '.sys ' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects SSTI attempts sent via GET requests in access logs. Logsource: webserver. Rule: title: Server Side Template Injection Strings id: ada3bc4f-f0fd-42b9-ba91-e105e8af7342 status: test description: Detects SSTI attempts sent via GET requests in access logs references: - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection - https://github.com/payloadbox/ssti-payloads author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-14 tags: - attack.stealth - attack.t1221 logsource: category: webserver detection: select_method: cs-method: GET keywords: - ={{ - =%7B%7B - =${ - =$%7B - =<%= - =%3C%25= - =@( - freemarker.template.utility.Execute - .getClass().forName('javax.script.ScriptEngineManager') - T(org.apache.commons.io.IOUtils) filter: sc-status: 404 condition: select_method and keywords and not filter falsepositives: - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high