alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects suspicious mshta process execution patterns
Matching passage: Sigma rule: Detects suspicious mshta process execution patterns. Logsource: windows / process_creation. Rule: title: Suspicious Mshta.EXE Execution Patterns id: e32f92d1-523e-49c3-9374-bdb13b46a3ba status: test description: Detects suspicious mshta process execution patterns references: - https://en.wikipedia.org/wiki/HTML_Application - https://www.echotrail.io/insights/search/mshta.exe - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-17 modified: 2023-02-21 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_susp: ParentImage|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe CommandLine|contains: - \AppData\Local\ - C:\ProgramData\ - C:\Users\Public\ - C:\Windows\Temp\ filter_img: - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - CommandLine|contains: - .htm - .hta - CommandLine|endswith: - mshta.exe - mshta condition: all of selection_* or (selection_img and not filter_img) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High Integrity. Logsource: windows / process_creation. Rule: title: Suspicious High IntegrityLevel Conhost Legacy Option id: 3037d961-21e9-4732-b27a-637bcc7bf539 status: test description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context. references: - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29 - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control author: frack113 date: 2022-12-09 modified: 2024-12-01 tags: - attack.stealth - attack.t1202 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - High - S-1-16-12288 CommandLine|contains|all: - conhost.exe - '0xffffffff' - -ForceV1 condition: selection falsepositives: - Very Likely, including launching cmd.exe via Run As Administrator level: informational
Query: write Sigma for Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a
Matching passage: Sigma rule: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install a. Logsource: windows / process_creation. Rule: title: Driver/DLL Installation Via Odbcconf.EXE id: 3f5491e2-8db8-496b-9e95-1029fce852d4 related: - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729 type: similar status: test description: Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs. references: - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176 - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|all: - 'INSTALLDRIVER ' - .dll condition: all of selection_* falsepositives: - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use MSHTA - PowerShell Module id: 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb related: - id: e55a5195-4724-480e-a77e-3ebe64bd3759 type: derived status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2023-01-04 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection falsepositives: - Unknown level: high
Query: exploit The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrar
Matching passage: CVE-2015-6055. CWE: CWE-119. CVSS: 9.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Filter arguments, aka "Scripting Engine Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7109. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: patch priority for CVE-2015-8138
Matching passage: CVE-2015-8138. CWE: CWE-20. CVSS: 5.300000190734863. NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.
Near-miss passage: CVE-2015-0633. CWE: CWE-20. CVSS: 6.800000190734863. The Integrated Management Controller (IMC) in Cisco Unified Computing System (UCS) 1.4(7h) and earlier on C-Series servers allows remote attackers to bypass intended access restrictions by sending crafted DHCP response packets on the local network, aka Bug ID CSCuf52876.
Query: vulnerability: Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and bef
Matching passage: CVE-2015-1324. CWE: CWE-264. CVSS: 7.800000190734863. Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries.
Near-miss passage: CVE-2015-2871. CWE: CWE-264. CVSS: 7.5. Chiyu BF-660C fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify communication configuration settings via a request to net.htm, a different vulnerability than CVE-2015-5618.
Query: risk of Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attac
Matching passage: CVE-2015-6938. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
Near-miss passage: CVE-2015-9102. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
Query: describe CVE-2015-6028
Matching passage: CVE-2015-6028. CWE: CWE-89. CVSS: 8.800000190734863. Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
Near-miss passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Query: detection rule: Detects potential RDP Session Hijacking activity on Windows systems
Matching passage: Sigma rule: Detects potential RDP Session Hijacking activity on Windows systems. Logsource: windows / process_creation. Rule: title: Potential RDP Session Hijacking Activity id: 224f140f-3553-4cd1-af78-13d81bf9f7cc status: test description: Detects potential RDP Session Hijacking activity on Windows systems references: - https://twitter.com/Moti_B/status/909449115477659651 author: '@juju4' date: 2022-12-27 modified: 2024-12-01 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \tscon.exe - OriginalFileName: tscon.exe selection_integrity: IntegrityLevel: - System - S-1-16-16384 condition: all of selection_* falsepositives: - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign. Logsource: windows / file_event. Rule: title: OneNote Attachment File Dropped In Suspicious Location id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0 status: test description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-09-19 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - :\Temp\ TargetFilename|endswith: - .one - .onepkg filter_main_onenote: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \ONENOTE.EXE condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of ".one" or ".onepkg" files from those locations level: medium
Query: explain CWE-636
Matching passage: CWE-636 Not Failing Securely ('Failing Open'). When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Near-miss passage: CWE-779 Logging of Excessive Data. The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
Query: CVE similar to CVE-2015-5440
Matching passage: CVE-2015-5440. CWE: CWE-200. CVSS: 4.900000095367432. HP UCMDB 10.00 and 10.01 before 10.01CUP12, 10.10 and 10.11 before 10.11CUP6, and 10.2x before 10.21 allows local users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7763. CWE: CWE-200. CVSS: 5.0. rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.
Query: describe CVE-2015-3268
Matching passage: CVE-2015-3268. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.
Near-miss passage: CVE-2015-9276. CWE: CWE-79. CVSS: 6.099999904632568. SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
Query: patch priority for CVE-2015-0473
Matching passage: CVE-2015-0473. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control MOS 12.1.0.5 and 12.1.0.6 allows remote attackers to affect integrity via unknown vectors related to My Oracle Support Plugin.
Near-miss passage: CVE-2015-1095. CWE: UNKNOWN. CVSS: 7.199999809265137. IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HID device.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects password change for the logged-on user's via "ksetup.exe". Logsource: windows / process_creation. Rule: title: Logged-On User Password Change Via Ksetup.EXE id: c9783e20-4793-4164-ba96-d9ee483992c4 status: test description: Detects password change for the logged-on user's via "ksetup.exe" references: - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-06 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ksetup.exe - OriginalFileName: ksetup.exe selection_cli: CommandLine|contains: ' /ChangePassword ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as. Logsource: windows / image_load. Rule: title: Time Travel Debugging Utility Usage - Image id: e76c8240-d68f-4773-8880-5c6f63595aaf status: test description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/ - https://twitter.com/mattifestation/status/1196390321783025666 - https://twitter.com/oulusoyum/status/1191329746069655553 author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-06 modified: 2022-12-02 tags: - attack.credential-access - attack.stealth - attack.t1218 - attack.t1003.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \ttdrecord.dll - \ttdwriter.dll - \ttdloader.dll condition: selection falsepositives: - Legitimate usage by software developers/testers level: high
Query: CVE similar to CVE-2015-3348
Matching passage: CVE-2015-3348. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title.
Near-miss passage: CVE-2015-2043. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem.
Query: risk of Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a differ
Matching passage: CVE-2015-8522. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8521.
Near-miss passage: CVE-2015-8778. CWE: CWE-119. CVSS: 9.800000190734863. Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
Query: vulnerability: Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via craf
Matching passage: CVE-2015-6309. CWE: CWE-399. CVSS: 6.800000190734863. Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.
Near-miss passage: CVE-2015-0586. CWE: CWE-399. CVSS: 7.800000190734863. The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682.
Query: vulnerability: Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Matching passage: CVE-2015-1301. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-7397. CWE: UNKNOWN. CVSS: 7.400000095367432. Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referrer parameter.
Query: Sigma rule for Detects when an Policy Rule is Modified or Deleted.
Matching passage: Sigma rule: Detects when an Policy Rule is Modified or Deleted.. Logsource: okta / okta. Rule: title: Okta Policy Rule Modified or Deleted id: 0c97c1d3-4057-45c9-b148-1de94b631931 status: test description: Detects when an Policy Rule is Modified or Deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.rule.update - policy.rule.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt. Logsource: windows / process_creation. Rule: title: Process Creation Attempt via Wmic.EXE id: 526be59f-a573-4eea-b5f7-f0973207634d related: - id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 type: derived status: test description: 'Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful. ' references: - https://www.sans.org/blog/wmic-for-incident-response/ - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community date: 2019-01-16 modified: 2023-02-14 tags: - attack.execution - attack.t1047 - car.2016-03-002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - process - call - create condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic red team name: WMI Execute Local Process technique: T1047 atomic_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_process_creation/info.yml
Query: Multiple failed authentications followed by Thread Execution Hijacking
Matching passage: T1055.003 Thread Execution Hijacking. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as <code>OpenThread</code>. At this point the process can be suspended then written to, realigned to the injected code, and resumed via <code>SuspendThread </code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation: Elastic Process Injection July 2017) This is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Near-miss passage: T1055.012 Process Hollowing. Tactics: stealth, privilege escalation. Description: Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as <code>CreateProcess</code>, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as <code>ZwUnmapViewOfSection</code> or <code>NtUnmapViewOfSection</code> before being written to, realigned to the injected code, and resumed via <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>SetThreadContext</code>, then <code>ResumeThread</code> respectively.(Citation: Leitch Hollowing)(Citation: Elastic Process Injection July 2017) This is very similar to [Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.