alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects possible password spraying attempts using Dsacls in logs
Matching passage: Sigma rule: Detects possible password spraying attempts using Dsacls. Logsource: windows / process_creation. Rule: title: Potential Password Spraying Attempt Using Dsacls.EXE id: bac9fb54-2da7-44e9-988f-11e9a5edbc0c status: test description: Detects possible password spraying attempts using Dsacls references: - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/using-dsacls-to-check-ad-object-permissions#password-spraying-anyone - https://ss64.com/nt/dsacls.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsacls.exe - OriginalFileName: DSACLS.EXE selection_cli: CommandLine|contains|all: - '/user:' - '/passwd:' condition: all of selection* falsepositives: - Legitimate use of dsacls to bind to an LDAP session level: medium
Near-miss passage: Sigma rule: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser LoginProfile Creation id: db014773-b1d3-46bd-ba26-133337c0ffee status: test description: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile. references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.execution - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1059.009 - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: - GetLoginProfile - CreateLoginProfile userAgent|contains: S3 Browser condition: selection falsepositives: - Valid usage of S3 Browser for IAM LoginProfile listing and/or creation level: high
Query: risk of Stack-based buffer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 1
Matching passage: CVE-2015-3100. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-1965. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1964.
Query: exploit Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing o
Matching passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Near-miss passage: CVE-2015-7207. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.
Query: rule covering Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious c
Matching passage: Sigma rule: Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious c. Logsource: windows / registry_set. Rule: title: Suspicious Environment Variable Has Been Registered id: 966315ef-c5e1-4767-ba25-fce9c8de3660 status: test description: Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings references: - https://infosec.exchange/@sbousseaden/109542254124022664 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-20 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains: \Environment\ selection_details: - Details: - powershell - pwsh - Details|contains: - \AppData\Local\Temp\ - C:\Users\Public\ - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA - SW52b2tlL - ludm9rZS - JbnZva2Ut - SQBuAHYAbwBrAGUALQ - kAbgB2AG8AawBlAC0A - JAG4AdgBvAGsAZQAtA - Details|startswith: - SUVY - SQBFAF - SQBuAH - cwBhA - aWV4 - aQBlA - R2V0 - dmFy - dgBhA - dXNpbm - H4sIA - Y21k - cABhAH - Qzpc - Yzpc condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of shell scripts under the "profile.d" path.. Logsource: linux / file_event. Rule: title: Potentially Suspicious Shell Script Creation in Profile Folder id: 13f08f54-e705-4498-91fd-cce9d9cee9f1 status: test description: Detects the creation of shell scripts under the "profile.d" path. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.persistence logsource: product: linux category: file_event detection: selection: TargetFilename|contains: /etc/profile.d/ TargetFilename|endswith: - .csh - .sh condition: selection falsepositives: - Legitimate shell scripts in the "profile.d" directory could be common in your environment. Apply additional filter accordingly via "image", by adding specific filenames you "trust" or by correlating it with other events. - Regular file creation during system update or software installation by the package manager level: low
Query: detection rule: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of mali
Matching passage: Sigma rule: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of mali. Logsource: windows / terminalservices-localsessionmanager. Rule: title: Ngrok Usage with Remote Desktop Service id: 64d51a51-32a6-49f0-9f3d-17e34d640272 status: test description: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour references: - https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg - https://ngrok.com/ author: Florian Roth (Nextron Systems) date: 2022-04-29 tags: - attack.command-and-control - attack.t1090 logsource: product: windows service: terminalservices-localsessionmanager detection: selection: EventID: 21 Address|contains: '16777216' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / system. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - System id: 11b52f18-aaec-4d60-9143-5dd8cc4706b9 status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-5884
Matching passage: CVE-2015-5884. CWE: CWE-200. CVSS: 3.299999952316284. The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during transmission of an S/MIME e-mail message with a large attachment.
Near-miss passage: CVE-2015-3058. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors.
Query: rule covering Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des
Matching passage: Sigma rule: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des. Logsource: windows / ps_script. Rule: title: Troubleshooting Pack Cmdlet Execution id: 03409c93-a7c7-49ba-9a4c-a00badf2a153 status: test description: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS) references: - https://twitter.com/nas_bench/status/1537919885031772161 - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.stealth - attack.t1202 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Invoke-TroubleshootingPack - C:\Windows\Diagnostics\System\PCW - -AnswerFile - -Unattended condition: selection falsepositives: - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes level: medium
Near-miss passage: Sigma rule: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j). Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by Java.EXE id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d related: - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 type: similar status: test description: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Florian Roth date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \AppVLP.exe - \bitsadmin.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \query.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: high
Query: describe CVE-2015-5446
Matching passage: CVE-2015-5446. CWE: UNKNOWN. CVSS: 7.5. HP StoreOnce Backup system software before 3.13.1 allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6680. CWE: UNKNOWN. CVSS: 10.0. Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6681.
Query: risk of cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a r
Matching passage: CVE-2015-3236. CWE: CWE-200. CVSS: 5.0. cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Query: vulnerability: The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop an
Matching passage: CVE-2015-4164. CWE: CWE-399. CVSS: 4.900000095367432. The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
Near-miss passage: CVE-2015-3289. CWE: CWE-399. CVSS: 4.0. OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them.
Query: vulnerability: Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certifica
Matching passage: CVE-2015-6251. CWE: UNKNOWN. CVSS: 5.0. Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
Near-miss passage: CVE-2015-8066. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary w
Matching passage: CVE-2015-9102. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
Near-miss passage: CVE-2015-10073. CWE: CWE-79. CVSS: 9.600000381469727. A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3066. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-1307. CWE: CWE-284. CVSS: 4.300000190734863. plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package.
Query: patch priority for CVE-2015-6334
Matching passage: CVE-2015-6334. CWE: CWE-20. CVSS: 5.0. Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a TACACS packet, aka Bug ID CSCuw01984.
Near-miss passage: CVE-2015-7691. CWE: CWE-20. CVSS: 7.5. The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
Query: weakness Improper Control of a Resource Through its Lifetime
Matching passage: CWE-664 Improper Control of a Resource Through its Lifetime. The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Near-miss passage: CWE-231 Improper Handling of Extra Values. The product does not handle or incorrectly handles when more values are provided than expected.
Query: telemetry for T1014
Matching passage: T1014 Rootkit. Tactics: stealth. Description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
Near-miss passage: T1535 Unused/Unsupported Cloud Regions. Tactics: stealth. Description: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected. A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)
Query: Sigma rule for Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse
Matching passage: Sigma rule: Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse. Logsource: windows / dns_query. Rule: title: DNS Query To Visual Studio Code Tunnels Domain id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://cydefops.com/vscode-data-exfiltration author: citron_ninja date: 2023-10-25 modified: 2023-11-20 tags: - attack.command-and-control - attack.t1071.001 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: .tunnels.api.visualstudio.com condition: selection falsepositives: - Legitimate use of Visual Studio Code tunnel will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high