alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused
Matching passage: Sigma rule: Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Netsh Helper DLL id: 56321594-9087-49d9-bf10-524fe8479452 related: - id: c90362e0-2df3-4e61-94fe-b37615814cb1 type: similar - id: e7b18879-676e-4a0e-ae18-27039185a8e7 type: similar status: test description: 'Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md - https://github.com/outflanknl/NetshHelperBeacon - https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/ author: Victor Sergeev, oscd.community date: 2019-10-25 modified: 2023-11-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 - attack.s0108 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: netsh.exe - Image|endswith: \netsh.exe selection_cli: CommandLine|contains|all: - add - helper condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious. Logsource: windows / process_creation. Rule: title: Execute From Alternate Data Streams id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c status: test description: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: frack113 date: 2021-09-01 modified: 2022-10-09 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_stream: CommandLine|contains: 'txt:' selection_tools_type: CommandLine|contains|all: - 'type ' - ' > ' selection_tools_makecab: CommandLine|contains|all: - 'makecab ' - .cab selection_tools_reg: CommandLine|contains|all: - 'reg ' - ' export ' selection_tools_regedit: CommandLine|contains|all: - 'regedit ' - ' /E ' selection_tools_esentutl: CommandLine|contains|all: - 'esentutl ' - ' /y ' - ' /d ' - ' /o ' condition: selection_stream and (1 of selection_tools_*) falsepositives: - Unknown level: medium
Query: detection rule: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
Matching passage: Sigma rule: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers. Logsource: windows / system. Rule: title: Mesh Agent Service Installation id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc status: test description: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: MeshAgent.exe - ServiceName|contains: Mesh Agent condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Near-miss passage: Sigma rule: Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe. Logsource: windows / process_creation. Rule: title: Execution via stordiag.exe id: 961e0abb-1b1e-4c84-a453-aafe56ad0d34 status: test description: Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe references: - https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html - https://twitter.com/eral4m/status/1451112385041911809 author: Austin Songer (@austinsonger) date: 2021-10-21 modified: 2022-12-25 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \stordiag.exe Image|endswith: - \schtasks.exe - \systeminfo.exe - \fltmc.exe filter: ParentImage|startswith: - c:\windows\system32\ - c:\windows\syswow64\ condition: selection and not filter falsepositives: - Legitimate usage of stordiag.exe. level: high
Query: vulnerability: Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet 
Matching passage: CVE-2015-5322. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
Near-miss passage: CVE-2015-6003. CWE: CWE-22. CVSS: 9.300000190734863. Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.
Query: Lateral movement indicators for Supply Chain Compromise
Matching passage: T1195 Supply Chain Compromise. Tactics: initial access. Description: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.
Near-miss passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Query: risk of The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-con
Matching passage: CVE-2015-2374. CWE: CWE-200. CVSS: 3.299999952316284. The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon."
Near-miss passage: CVE-2015-7399. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the HTTP server via unspecified vectors.
Query: rule covering Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Matching passage: Sigma rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.. Logsource: windows / security. Rule: title: Startup/Logon Script Added to Group Policy Object id: 123e4e6d-b123-48f8-b261-7214938acaf0 status: test description: 'Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. ' references: - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html author: Elastic, Josh Nickels, Marius Rothenbücher date: 2024-09-06 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 - attack.t1547 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_eventid: EventID: - 5136 - 5145 selection_attributes_main: AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3 selection_attributes_optional: AttributeValue|contains: - 40B6664F-4972-11D1-A7CA-0000F87571E3 - 40B66650-4972-11D1-A7CA-0000F87571E3 selection_share: ShareName|endswith: \SYSVOL RelativeTargetName|endswith: - \scripts.ini - \psscripts.ini AccessList|contains: '%%4417' condition: selection_eventid and (all of selection_attributes_* or selection_share) falsepositives: - Legitimate execution by system administrators. level: medium
Near-miss passage: Sigma rule: Detects usage of Gpg4win to decrypt files. Logsource: windows / process_creation. Rule: title: File Decryption Using Gpg4win id: 037dcd71-33a8-4392-bb01-293c94663e5a status: test description: Detects usage of Gpg4win to decrypt files references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://www.gpg4win.de/documentation.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains|all: - ' -d ' - passphrase condition: all of selection_* falsepositives: - Unknown level: medium
Query: telemetry for T1213.001
Matching passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Query: risk of The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted L
Matching passage: CVE-2015-7506. CWE: CWE-125. CVSS: 6.5. The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted LZW stream in a GIF file.
Near-miss passage: CVE-2015-9290. CWE: CWE-125. CVSS: 9.800000190734863. In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
Query: write Sigma for Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe
Matching passage: Sigma rule: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe. Logsource: windows / image_load. Rule: title: Amsi.DLL Loaded Via LOLBIN Process id: 6ec86d9e-912e-4726-91a2-209359b999b9 status: test description: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack references: - Internal Research - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \amsi.dll Image|endswith: - \ExtExport.exe - \odbcconf.exe - \rundll32.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Silent Installation id: 114e7f1c-f137-48c8-8f54-3088c24ce4b9 status: test description: Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access. references: - https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20 - https://support.anydesk.com/Automatic_Deployment author: Ján Trenčanský date: 2021-08-06 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --install - --start-with-win - --silent condition: selection falsepositives: - Legitimate deployment of AnyDesk level: high
Query: CVE similar to CVE-2015-3233
Matching passage: CVE-2015-3233. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Near-miss passage: CVE-2015-0400. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.
Query: Sigma rule for HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outloo
Matching passage: Sigma rule: HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outloo. Logsource: windows / process_creation. Rule: title: Potential Fake Instance Of Hxtsr.EXE Executed id: 4e762605-34a8-406d-b72e-c1a089313320 status: test description: 'HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe ' references: - Internal Research author: Sreeman date: 2020-04-17 modified: 2024-02-08 tags: - attack.stealth - attack.t1036 logsource: product: windows category: process_creation detection: selection: Image|endswith: \hxtsr.exe filter_main_hxtsr: Image|contains: :\program files\windowsapps\microsoft.windowscommunicationsapps_ Image|endswith: \hxtsr.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand. Logsource: windows / process_creation. Rule: title: Possible Privilege Escalation via Weak Service Permissions id: d937b75f-a665-4480-88a5-2f20e9f9b22a status: test description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/30/weak-service-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: scbynonadmin: Image|endswith: \sc.exe IntegrityLevel: - Medium - S-1-16-8192 selection_binpath: CommandLine|contains|all: - config - binPath selection_failure: CommandLine|contains|all: - failure - command condition: scbynonadmin and 1 of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2
Matching passage: CVE-2015-1649. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Near-miss passage: CVE-2015-5428. CWE: UNKNOWN. CVSS: 7.5. HP Matrix Operating Environment before 7.5.0 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2015-5427 and CVE-2015-5429.
Query: detect Detect set Notification_Suppress to 1 to disable the Windows security center notification in logs
Matching passage: Sigma rule: Detect set Notification_Suppress to 1 to disable the Windows security center notification. Logsource: windows / registry_set. Rule: title: Activate Suppression of Windows Security Center Notifications id: 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 status: test description: Detect set Notification_Suppress to 1 to disable the Windows security center notification references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration\Notification_Suppress Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy executi. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of BgInfo.EXE id: aaf46cdc-934e-4284-b329-34aa701e3771 related: - id: 811f459f-9231-45d4-959a-0266c6311987 type: similar status: test description: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/ - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/ author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community date: 2019-10-26 modified: 2023-08-16 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \bginfo.exe - \bginfo64.exe condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "e
Matching passage: CVE-2015-8603. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to serendipity_admin.php.
Near-miss passage: CVE-2015-0882. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the n
Matching passage: CVE-2015-2220. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Near-miss passage: CVE-2015-0128. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124.