alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for azure / auditlogs
Matching passage: Sigma rule: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or A. Logsource: azure / auditlogs. Rule: title: App Granted Microsoft Permissions id: c1d147ae-a951-48e5-8b41-dcd0170c7213 status: test description: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-10 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: properties.message: - Add delegated permission grant - Add app role assignment to service principal condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Near-miss passage: Sigma rule: An application has been removed. Check if it is critical.. Logsource: windows / application. Rule: title: Application Uninstalled id: 570ae5ec-33dc-427c-b815-db86228ad43e status: test description: An application has been removed. Check if it is critical. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging author: frack113 date: 2022-01-28 modified: 2022-09-17 tags: - attack.impact - attack.t1489 logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1034 - 11724 condition: selection falsepositives: - Unknown level: low
Query: explain CWE-1118
Matching passage: CWE-1118 Insufficient Documentation of Error Handling Techniques. The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms.
Near-miss passage: CWE-1070 Serializable Data Element Containing non-Serializable Item Elements. The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.
Query: CVE similar to CVE-2015-5644
Matching passage: CVE-2015-5644. CWE: CWE-94. CVSS: 6.800000190734863. The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
Near-miss passage: CVE-2015-1698. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1699.
Query: patch priority for CVE-2015-7412
Matching passage: CVE-2015-7412. CWE: CWE-200. CVSS: 2.5999999046325684. The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.
Near-miss passage: CVE-2015-4536. CWE: CWE-200. CVSS: 3.5. EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.
Query: patch priority for CVE-2015-8041
Matching passage: CVE-2015-8041. CWE: CWE-189. CVSS: 5.0. Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-4467. CWE: CWE-189. CVSS: 4.300000190734863. The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.
Query: patch priority for CVE-2015-0060
Matching passage: CVE-2015-0060. CWE: CWE-19. CVSS: 4.699999809265137. The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability."
Near-miss passage: CVE-2015-8240. CWE: CWE-19. CVSS: 7.5. The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.
Query: CVE similar to CVE-2015-3124
Matching passage: CVE-2015-3124. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-8435. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: risk of The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive i
Matching passage: CVE-2015-5697. CWE: CWE-200. CVSS: 2.0999999046325684. The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
Near-miss passage: CVE-2015-3238. CWE: CWE-200. CVSS: 6.5. The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
Query: CVE similar to CVE-2015-6296
Matching passage: CVE-2015-6296. CWE: CWE-264. CVSS: 7.199999809265137. Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by leveraging knowledge of the credentials, aka Bug ID CSCuw21825.
Near-miss passage: CVE-2015-1342. CWE: CWE-264. CVSS: 4.599999904632568. LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
Query: vulnerability: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confide
Matching passage: CVE-2015-2594. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Near-miss passage: CVE-2015-0320. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, and CVE-2015-0322.
Query: mitigate Cloud Accounts
Matching passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Near-miss passage: T1585.001 Social Media Accounts. Tactics: resource development. Description: Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of a persona on social media may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Establishing a persona on social media may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Once a persona has been developed an adversary can use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).
Query: detection rule: Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a websh
Matching passage: Sigma rule: Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a websh. Logsource: windows / msexchange-management. Rule: title: Certificate Request Export to Exchange Webserver id: b7bc7038-638b-4ffd-880c-292c692209ef status: test description: Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell references: - https://twitter.com/GossiTheDog/status/1429175908905127938 author: Max Altgelt (Nextron Systems) date: 2021-08-23 modified: 2023-01-23 tags: - attack.persistence - attack.t1505.003 logsource: service: msexchange-management product: windows detection: keywords_export_command: '|all': - New-ExchangeCertificate - ' -GenerateRequest' - ' -BinaryEncoded' - ' -RequestFile' keywords_export_params: - \\\\localhost\\C$ - \\\\127.0.0.1\\C$ - C:\\inetpub - .aspx condition: keywords_export_command and keywords_export_params falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63). Logsource: windows / process_creation. Rule: title: UAC Bypass Using DismHost id: 853e74f9-9392-4935-ad3b-2e8c040dae86 status: test description: Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - C:\Users\ - \AppData\Local\Temp\ - \DismHost.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4109
Matching passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-4342. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Query: CVE similar to CVE-2015-1443
Matching passage: CVE-2015-1443. CWE: CWE-20. CVSS: 8.800000190734863. The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-5014. CWE: CWE-20. CVSS: 9.300000190734863. IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation.
Query: Sigma YAML for windows / ps_classic_start
Matching passage: Sigma rule: Shadow Copies deletion using operating systems utilities via PowerShell. Logsource: windows / ps_classic_start. Rule: title: Delete Volume Shadow Copies Via WMI With PowerShell id: 87df9ee1-5416-453a-8a08-e8d4a51e9ce1 status: stable description: Shadow Copies deletion using operating systems utilities via PowerShell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods author: frack113 date: 2021-06-03 modified: 2023-10-27 tags: - attack.impact - attack.t1490 logsource: product: windows category: ps_classic_start detection: selection: Data|contains|all: - Get-WmiObject - Win32_ShadowCopy Data|contains: - Delete() - Remove-WmiObject condition: selection falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason level: high
Near-miss passage: Sigma rule: Detects the use of Tor or Tor-Browser to connect to onion routing networks. Logsource: windows / process_creation. Rule: title: Tor Client/Browser Execution id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c status: test description: Detects the use of Tor or Tor-Browser to connect to onion routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ author: frack113 date: 2022-02-20 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1090.003 logsource: category: process_creation product: windows detection: selection: - Description: Tor Browser - Product: Tor Browser - Image|endswith: - \tor.exe - \Tor Browser\Browser\firefox.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
Query: risk of Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487.
Matching passage: CVE-2015-8488. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487.
Near-miss passage: CVE-2015-7328. CWE: CWE-200. CVSS: 4.699999809265137. Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.
Query: intelligence brief on T1590.003
Matching passage: T1590.003 Network Trust Dependencies. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: Pentesting AD Forests) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1590 Gather Victim Network Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: describe CVE-2015-0323
Matching passage: CVE-2015-0323. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327.
Near-miss passage: CVE-2015-3738. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: Sigma rule for Detects Obfuscated Powershell via use MSHTA in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use MSHTA - PowerShell id: e55a5195-4724-480e-a77e-3ebe64bd3759 status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.. Logsource: windows / process_creation. Rule: title: Suspicious Process Created Via Wmic.EXE id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 related: - id: 526be59f-a573-4eea-b5f7-f0973207634d type: derived status: test description: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc. references: - https://thedfirreport.com/2020/10/08/ryuks-return/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-10-12 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'process ' - 'call ' - 'create ' CommandLine|contains: - rundll32 - bitsadmin - regsvr32 - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - powershell - pwsh - certutil - cscript - wscript - mshta - \Users\Public\ - \Windows\Temp\ - \AppData\Local\ - '%temp%' - '%tmp%' - '%ProgramData%' - '%appdata%' - '%comspec%' - '%localappdata%' condition: selection falsepositives: - Unknown level: high simulation: - type: atomic red team name: WMI Execute rundll32 technique: T1047 atomic_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation/info.yml