alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a in logs
Matching passage: Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium
Near-miss passage: Sigma rule: Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new fil. Logsource: macos / process_creation. Rule: title: Potential Base64 Decoded From Images id: 09a910bf-f71f-4737-9c40-88880ba5913d status: test description: 'Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner. ' references: - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 tags: - attack.stealth - attack.t1140 logsource: product: macos category: process_creation detection: selection_image: Image|endswith: /bash selection_view: CommandLine|contains|all: - tail - -c selection_b64: CommandLine|contains|all: - base64 - -d - '>' selection_files: CommandLine|contains: - .avif - .gif - .jfif - .jpeg - .jpg - .pjp - .pjpeg - .png - .svg - .webp condition: all of selection_* falsepositives: - Unknown level: high
Query: detect Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and s in logs
Matching passage: Sigma rule: Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and s. Logsource: linux / process_creation. Rule: title: Inline Python Execution - Spawn Shell Via OS System Library id: 2d2f44ff-4611-4778-a8fc-323a0e9850cc status: test description: 'Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell. ' references: - https://gtfobins.github.io/gtfobins/python/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_cli: CommandLine|contains|all: - ' -c ' - os.system( CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll,. Logsource: zeek / http. Rule: title: HTTP Request to Low Reputation TLD or Suspicious File Extension id: 68c2c604-92ad-468b-bf4a-aac49adad08c status: experimental description: 'Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity. ' references: - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows - https://www.spamhaus.org/reputation-statistics/cctlds/domains/ author: '@signalblur, Corelight' date: 2025-02-26 tags: - attack.initial-access - attack.command-and-control logsource: product: zeek service: http detection: selection_suspicious_tld: host|endswith: - .bid - .by - .cf - .click - .cm - .ga - .gq - .ir - .kp - .loan - .ml - .mm - .party - .pw - .ru - .su - .sy - .tk - .top - .tv - .ve - .work - .xyz selection_malicious_ext: uri|endswith: - .bat - .bin - .cmd - .cpl - .dll - .dylib - .elf - .exe - .hta - .iso - .jar - .js - .lnk - .msi - .pif - .ps1 - .py - .reg - .scr - .sh - .so - .vbs - .wsf selection_malicious_mime: resp_mime_types: - application/vnd.microsoft.portable-executable - application/x-bat - application/x-dosexec - application/x-elf - application/x-iso9660-image - application/x-java-archive - application/x-ms-shortcut - application/x-msdos-program - application/x-msdownload - application/x-python-code - application/x-sh condition: selection_suspicious_tld and 1 of selection_malicious_* falsepositives: - Rare legitimate software downloads from low quality TLDs level: medium
Query: exploit The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a mal
Matching passage: CVE-2015-7219. CWE: CWE-189. CVSS: 5.0. The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation.
Near-miss passage: CVE-2015-1219. CWE: CWE-189. CVSS: 7.5. Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.
Query: indicators of InstallUtil
Matching passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Near-miss passage: T1218 System Binary Proxy Execution. Tactics: stealth. Description: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
Query: CWE for Missing Release of File Descriptor or Handle after Effective Lifetime
Matching passage: CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime. The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.
Near-miss passage: CWE-692 Incomplete Denylist to Cross-Site Scripting. The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Query: patch priority for CVE-2015-6367
Matching passage: CVE-2015-6367. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Aironet 1800 devices with software 8.1(131.0) allow remote attackers to cause a denial of service (CPU consumption) by improperly establishing many SSHv2 connections, aka Bug ID CSCux13374.
Near-miss passage: CVE-2015-0031. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041.
Query: weakness Improper Handling of Hardware Behavior in Exceptionally Cold Environments
Matching passage: CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments. A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.
Near-miss passage: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'). The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Query: write Sigma for Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Matching passage: Sigma rule: Detects suspicious connections from Microsoft Sync Center to non-private IPs.. Logsource: windows / network_connection. Rule: title: Microsoft Sync Center Suspicious Network Connections id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b status: test description: Detects suspicious connections from Microsoft Sync Center to non-private IPs. references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 modified: 2024-03-12 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1218 - attack.execution logsource: product: windows category: network_connection detection: selection: Image|endswith: \mobsync.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order t. Logsource: windows / security. Rule: title: Important Scheduled Task Deleted/Disabled id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-03-13 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection: EventID: - 4699 - 4701 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\Schedule - \Windows\ExploitGuard filter_main_defender_update: EventID: 4699 SubjectUserName|endswith: $ TaskName|contains: \Windows\Windows Defender\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Query: CVE similar to CVE-2015-5254
Matching passage: CVE-2015-5254. CWE: CWE-20. CVSS: 9.800000190734863. Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Near-miss passage: CVE-2015-1492. CWE: CWE-20. CVSS: 8.5. Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan horse DLL in a client install package.
Query: detection rule: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
Matching passage: Sigma rule: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys. Logsource: windows / registry_set. Rule: title: Potential Persistence Via GlobalFlags id: 36803969-5421-41ec-b92f-8500f79c23b0 related: - id: c81fe886-cac0-4913-a511-2822d72ff505 type: obsolete status: test description: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys references: - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/ author: Karneades, Jonhnathan Ribeiro, Florian Roth date: 2018-04-11 modified: 2023-06-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.012 - car.2013-01-002 logsource: category: registry_set product: windows detection: selection_global_flag: TargetObject|contains|all: - \Microsoft\Windows NT\CurrentVersion\ - \Image File Execution Options\ - \GlobalFlag selection_silent_process: TargetObject|contains|all: - \Microsoft\Windows NT\CurrentVersion\ - \SilentProcessExit\ TargetObject|contains: - \ReportingMode - \MonitorProcess condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: zeek / smb_files. Rule: title: Transferring Files with Credential Data via Network Shares - Zeek id: 2e69f167-47b5-4ae7-a390-47764529eff5 related: - id: 910ab938-668b-401b-b08c-b596e80fdca5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: '@neu5ron, Teymur Kheirkhabarov, oscd.community' date: 2020-04-02 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: zeek service: smb_files detection: selection: name: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - \sam - \ntds.dit - \security condition: selection falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium
Query: vulnerability: Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do o
Matching passage: CVE-2015-2858. CWE: UNKNOWN. CVSS: 7.5. Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.
Near-miss passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Query: exploit Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote a
Matching passage: CVE-2015-2862. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.
Near-miss passage: CVE-2015-6914. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Query: CWE for Insufficient Control Flow Management
Matching passage: CWE-691 Insufficient Control Flow Management. The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
Near-miss passage: CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
Query: patch priority for CVE-2015-3165
Matching passage: CVE-2015-3165. CWE: UNKNOWN. CVSS: 4.300000190734863. Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
Near-miss passage: CVE-2015-7078. CWE: UNKNOWN. CVSS: 7.199999809265137. Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
Query: risk of The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.
Matching passage: CVE-2015-4046. CWE: CWE-77. CVSS: 7.199999809265137. The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.
Near-miss passage: CVE-2015-4336. CWE: CWE-77. CVSS: 6.5. cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Query: vulnerability: ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
Matching passage: CVE-2015-7977. CWE: CWE-476. CVSS: 5.900000095367432. ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
Near-miss passage: CVE-2015-8926. CWE: CWE-476. CVSS: 5.5. The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
Query: exploit GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensitive information and ex
Matching passage: CVE-2015-0863. CWE: CWE-264. CVSS: 8.0. GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
Near-miss passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Query: CVE similar to CVE-2015-1637
Matching passage: CVE-2015-1637. CWE: CWE-310. CVSS: 4.300000190734863. Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067.
Near-miss passage: CVE-2015-4288. CWE: CWE-310. CVSS: 4.300000190734863. The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.