alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do
Matching passage: Sigma rule: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do. Logsource: windows / process_creation. Rule: title: Remote File Download Via Desktopimgdownldr Utility id: 214641c2-c579-4ecb-8427-0cf19df6842e status: test description: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. references: - https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \desktopimgdownldr.exe ParentImage|endswith: \desktopimgdownldr.exe CommandLine|contains: /lockscreenurl:http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdst. Logsource: windows / process_creation. Rule: title: Uninstall Crowdstrike Falcon Sensor id: f0f7be61-9cf5-43be-9836-99d6ef448a18 status: test description: Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: frack113 date: 2021-07-12 modified: 2023-03-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \WindowsSensor.exe - ' /uninstall' - ' /quiet' condition: selection falsepositives: - Administrator might leverage the same command line for debugging or other purposes. However this action must be always investigated level: high
Query: vulnerability: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3121. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3120, CVE-2015-3122, and CVE-2015-4433.
Near-miss passage: CVE-2015-5555. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5558, and CVE-2015-5562.
Query: detect Archive via Library
Matching passage: T1560.002 Archive via Library. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Near-miss passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Query: CVE similar to CVE-2015-8615
Matching passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Near-miss passage: CVE-2015-7044. CWE: CWE-254. CVSS: 7.599999904632568. The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Query: describe CVE-2015-0145
Matching passage: CVE-2015-0145. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-4353. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors.
Query: actor TTPs: Active Setup
Matching passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Near-miss passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Query: actor TTPs: DCSync
Matching passage: T1003.006 DCSync. Tactics: credential access. Description: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
Near-miss passage: T1003.003 NTDS. Tactics: credential access. Description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy
Query: CVE similar to CVE-2015-4724
Matching passage: CVE-2015-4724. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Concrete5 5.7.3.1.
Near-miss passage: CVE-2015-4222. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325.
Query: exploit Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1,
Matching passage: CVE-2015-2530. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2514.
Near-miss passage: CVE-2015-7835. CWE: CWE-20. CVSS: 7.199999809265137. The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
Query: detect Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. in logs
Matching passage: Sigma rule: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Alternate Data Stream Execution id: 6b369ced-4b1d-48f1-b427-fdc0de0790bd status: test description: Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-12-31 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Very Possible level: medium
Near-miss passage: Sigma rule: Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.. Logsource: windows / process_creation. Rule: title: Screen Capture Activity Via Psr.EXE id: 2158f96f-43c2-43cb-952a-ab4580f32382 status: test description: Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks. references: - https://lolbas-project.github.io/lolbas/Binaries/Psr/ - https://web.archive.org/web/20200229201156/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493861893.pdf - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Beyu Denis, oscd.community date: 2019-10-12 modified: 2024-01-04 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection: Image|endswith: \Psr.exe CommandLine|contains: - /start - -start condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for gcp / gcp.audit
Matching passage: Sigma rule: Detects when storage bucket is modified or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Modified or Deleted id: 4d9f2ee2-c903-48ab-b9c1-8c0f474913d0 status: test description: Detects when storage bucket is modified or deleted in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.delete - storage.buckets.insert - storage.buckets.update - storage.buckets.patch condition: selection falsepositives: - Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the use of the "capsh" utility to invoke a shell.. Logsource: linux / process_creation. Rule: title: Capsh Shell Invocation - Linux id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a status: test description: 'Detects the use of the "capsh" utility to invoke a shell. ' references: - https://gtfobins.github.io/gtfobins/capsh/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: Image|endswith: /capsh CommandLine|endswith: ' --' condition: selection falsepositives: - Unknown level: high
Query: alert when Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are
Matching passage: Sigma rule: Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are. Logsource: zeek / dce_rpc. Rule: title: Potential PetitPotam Attack Via EFS RPC Calls id: 4096842a-8f9f-4d36-92b4-d0b2a62f9b2a status: test description: "Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this\ \ RPC are used within the attack refereed to as PetitPotam.\nThe usage of this RPC function should be rare if ever used\ \ at all.\nThus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation\ \ to determine if it is legitimate.\n View surrounding logs (within a few minutes before and after) from the Source IP to.\ \ Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'\n" references: - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003 - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf - https://threatpost.com/microsoft-petitpotam-poc/168163/ author: '@neu5ron, @Antonlovesdnb, Mike Remen' date: 2021-08-17 modified: 2022-11-28 tags: - attack.collection - attack.credential-access - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dce_rpc detection: selection: operation|startswith: efs condition: selection falsepositives: - Uncommon but legitimate windows administrator or software tasks that make use of the Encrypting File System RPC Calls. Verify if this is common activity (see description). level: medium
Near-miss passage: Sigma rule: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Uncommon Script Extension Execution id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee status: test description: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-06-19 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - wscript.exe - cscript.exe - Image|endswith: - \wscript.exe - \cscript.exe selection_extension: CommandLine|contains: - .csv - .dat - .doc - .gif - .jpeg - .jpg - .png - .ppt - .txt - .xls - .xml condition: all of selection_* falsepositives: - Unknown level: high
Query: weakness Deadlock
Matching passage: CWE-833 Deadlock. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Near-miss passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Query: patch priority for CVE-2015-9336
Matching passage: CVE-2015-9336. CWE: CWE-79. CVSS: 6.099999904632568. The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
Near-miss passage: CVE-2015-10075. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Query: vulnerability: Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, 
Matching passage: CVE-2015-5567. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5579.
Near-miss passage: CVE-2015-5523. CWE: CWE-119. CVSS: 4.300000190734863. The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.
Query: patch priority for CVE-2015-5053
Matching passage: CVE-2015-5053. CWE: CWE-284. CVSS: 10.0. The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory, which allows attackers to gain privileges, cause a denial of service (resource consumption), or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call.
Near-miss passage: CVE-2015-1464. CWE: CWE-284. CVSS: 6.400000095367432. RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
Query: patch priority for CVE-2015-7663
Matching passage: CVE-2015-7663. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-4797. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security.
Query: risk of J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3
Matching passage: CVE-2015-3004. CWE: CWE-20. CVSS: 4.300000190734863. J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, and 14.2 before 14.2R1 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header.
Near-miss passage: CVE-2015-4327. CWE: CWE-20. CVSS: 7.199999809265137. The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.